Emilvirkki

**Name of the Vulnerable Software and Affected Versions** calibre versions prior to 9.6.0 **Description** A Server-Side Request Forgery (SSRF) issue in the 'background-image' endpoint of the web view allows an attacker to perform blind GET requests to arbitrary URLs. This can lead to the exfiltration of information from the ebook sandbox. SSRF is a flaw where an attacker can force a server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing. **Recommendations** Update to version 9.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** calibre versions prior to 9.6.0 **Description** A path traversal issue exists in the handling of images within Markdown and similar text-based files, which allows an attacker to include arbitrary files from the file system into a converted book. Furthermore, the 'background-image' endpoint in the ebook reader web view lacks authentication and is susceptible to server-side request forgery (SSRF), a flaw where the server is tricked into making unintended requests, enabling the exfiltration of files without further interaction. **Recommendations** Update to version 9.6.0.

**Name of the Vulnerable Software and Affected Versions** PHPSpreadsheet versions prior to 1.29.2 PHPSpreadsheet versions prior to 2.1.1 PHPSpreadsheet versions prior to 2.3.0 **Description** It's possible for an attacker to construct an XLSX file which links media from external URLs. When opening the XLSX file, PHPSpreadsheet retrieves the image size and type by reading the file contents, if the provided path is a URL. By using specially crafted `php://filter` URLs, an attacker can leak the contents of any file or URL. An attacker can access any file on the server, or leak information from arbitrary URLs, potentially exposing sensitive information such as AWS IAM credentials. **Recommendations** For PHPSpreadsheet versions prior to 1.29.2, update to version 1.29.2 or later. For PHPSpreadsheet versions prior to 2.1.1, update to version 2.1.1 or later. For PHPSpreadsheet versions prior to 2.3.0, update to version 2.3.0 or later. As a temporary workaround, consider disabling the `setPath()` function until a patch is available. Restrict access to the vulnerable `xl/drawings/ rels/drawing1.xml.rels` file to minimize the risk of exploitation. Avoid using the `php://filter` URLs in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** PHPSpreadsheet versions prior to 1.29.2 PHPSpreadsheet versions prior to 2.1.1 PHPSpreadsheet versions prior to 2.3.0 **Description** The issue allows an attacker to construct an XLSX file that links images from arbitrary paths. When embedding images has been enabled in HTML writer, those files will be included in the output as `data:` URLs, regardless of the file's type. Also, URLs can be used for embedding, resulting in a Server-Side Request Forgery vulnerability. An attacker can read arbitrary files on the server and perform arbitrary HTTP GET requests. Note that any PHP protocol wrappers can be used, meaning that if, for example, the `expect://` wrapper is enabled, also remote code execution is possible. **Recommendations** For PHPSpreadsheet versions prior to 1.29.2, upgrade to version 1.29.2 or later. For PHPSpreadsheet versions prior to 2.1.1, upgrade to version 2.1.1 or later. For PHPSpreadsheet versions prior to 2.3.0, upgrade to version 2.3.0 or later. As a temporary workaround, consider disabling the embedding of images in the HTML writer by setting `$writer->setEmbedImages(false);` until a patch is available. Restrict access to the `file get contents()` function to minimize the risk of exploitation. Avoid using the `php://` protocol wrapper in the `Target` attribute of the `Relationship` element in the `xl/drawings/ rels/drawing1.xml.rels` file.

**Name of the Vulnerable Software and Affected Versions** PHPSpreadsheet versions prior to 1.29.2 PHPSpreadsheet versions prior to 2.1.1 PHPSpreadsheet versions prior to 2.3.0 **Description** The `PhpOfficePhpSpreadsheetWriterHtml` component in PHPSpreadsheet does not sanitize "javascript:" URLs from hyperlink `href` attributes, resulting in a Cross-Site Scripting issue. This allows for potential exploitation when a user interacts with a crafted spreadsheet file. There are no known workarounds for this issue. **Recommendations** For PHPSpreadsheet versions prior to 1.29.2, upgrade to version 1.29.2 or later. For PHPSpreadsheet versions prior to 2.1.1, upgrade to version 2.1.1 or later. For PHPSpreadsheet versions prior to 2.3.0, upgrade to version 2.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** PHPSpreadsheet versions prior to 2.1.0 **Description** The issue concerns the `PhpOfficePhpSpreadsheetWriterHtml` component, which fails to sanitize spreadsheet styling information, such as font names. This allows an attacker to inject arbitrary JavaScript on the page, potentially leading to a full takeover of a user's session when viewing spreadsheet files as HTML. **Recommendations** For versions prior to 2.1.0, upgrade to release version 2.1.0 to address the issue. As a temporary workaround, consider disabling the `PhpOfficePhpSpreadsheetWriterHtml` component until a patch is available. Restrict access to the vulnerable `PhpOfficePhpSpreadsheetWriterHtml` component to minimize the risk of exploitation. Avoid using the affected PHPSpreadsheet library for viewing spreadsheet files as HTML until the issue is resolved.