PT-2024-31397 · Phpoffice · Phpspreadsheet

Emilvirkki · Published 2024-08-28 · Updated 2024-09-04 · CVE-2024-45046

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHPSpreadsheet versions prior to 2.1.0

Description The issue concerns the PhpOfficePhpSpreadsheetWriterHtml component, which fails to sanitize spreadsheet styling information, such as font names. This allows an attacker to inject arbitrary JavaScript on the page, potentially leading to a full takeover of a user's session when viewing spreadsheet files as HTML.

Recommendations For versions prior to 2.1.0, upgrade to release version 2.1.0 to address the issue. As a temporary workaround, consider disabling the PhpOfficePhpSpreadsheetWriterHtml component until a patch is available. Restrict access to the vulnerable PhpOfficePhpSpreadsheetWriterHtml component to minimize the risk of exploitation. Avoid using the affected PHPSpreadsheet library for viewing spreadsheet files as HTML until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-45046

GHSA-WGMF-Q9VR-VWW6

Affected Products

Phpspreadsheet

References · 12

• 🔥 https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45046.json · Exploit
• https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667 · Patch
• https://github.com/PHPOffice/PhpSpreadsheet/pull/3957 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-45046 · Security Note
• https://osv.dev/vulnerability/GHSA-wgmf-q9vr-vww6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45046 · Vendor Advisory
• https://github.com/PHPOffice/PhpSpreadsheet · Note
• https://twitter.com/VulmonFeeds/status/1828923857329074472 · Twitter Post
• https://t.me/cvedetector/4359 · Telegram Post
• https://twitter.com/CVESource/status/1828910584814870623 · Twitter Post
• https://twitter.com/CVEnew/status/1828898179112182093 · Twitter Post