PT-2024-10175 · Unknown · Phpspreadsheet

Aleksey Solovev · Published 2024-12-23 · Updated 2025-01-03 · CVE-2024-56410

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions prior to 3.7.0 PhpSpreadsheet versions prior to 2.3.5 PhpSpreadsheet versions prior to 2.1.6 PhpSpreadsheet versions prior to 1.29.7

Description The issue is related to a cross-site scripting (XSS) vulnerability in custom properties. The HTML page is generated without clearing custom properties, which can allow an attacker to execute arbitrary JavaScript code in the browser. The vulnerable component is the PhpOfficePhpSpreadsheetWriterHtml class, specifically the generateMeta method. An attacker can embed a payload in a file property that will result in the execution of arbitrary JavaScript code when the Excel file is converted to an HTML representation.

Recommendations For versions prior to 3.7.0, update to version 3.7.0 or later. For versions prior to 2.3.5, update to version 2.3.5 or later. For versions prior to 2.1.6, update to version 2.1.6 or later. For versions prior to 1.29.7, update to version 1.29.7 or later. As a temporary workaround, consider additional sanitization of special characters in strings to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-00502

CVE-2024-56410

GHSA-WV23-996V-Q229

Affected Products

Phpspreadsheet

References · 14

• 🔥 https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wv23-996v-q229 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56410.json · Exploit
• https://github.com/PHPOffice/PhpSpreadsheet/commit/45052f88e04c735d56457a8ffcdc40b2635a028e · Patch
• https://bdu.fstec.ru/vul/2025-00502 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56410 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56410 · Security Note
• https://osv.dev/vulnerability/GHSA-wv23-996v-q229 · Vendor Advisory
• https://github.com/PHPOffice/PhpSpreadsheet · Note
• https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6f4521982d0b4 · Note
• https://twitter.com/CVEnew/status/1875235452027814072 · Twitter Post
• https://t.me/cvedetector/14240 · Telegram Post
• https://t.me/cvenotify/106224 · Telegram Post
• https://vuldb.com/?id.290172 · Note
• https://twitter.com/VulmonFeeds/status/1875297004680601905 · Twitter Post