PT-2024-31412 · Unknown · Phpspreadsheet

Stealthcopter · Published 2024-10-07 · Updated 2024-10-17 · CVE-2024-45060

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions PHPSpreadsheet versions prior to 1.29.2 PHPSpreadsheet versions prior to 2.1.1 PHPSpreadsheet versions prior to 2.3.0

Description The issue is related to a cross-site scripting (XSS) vulnerability in one of the sample scripts in PHPSpreadsheet, specifically due to improper handling of input where a number is expected, leading to formula injection. The code in 45 Quadratic equation solver.php concatenates user-supplied parameters directly into spreadsheet formulas, allowing an attacker to take control over the formula and output unsanitized data into the page, resulting in JavaScript execution. The impact of this vulnerability is expected to be relatively low since these are sample files that should not be included when the library is used properly. However, some popular WordPress plugins have unintentionally exposed this file, and addressing this issue can enhance security for users.

Recommendations For PHPSpreadsheet versions prior to 1.29.2, upgrade to version 1.29.2 or later. For PHPSpreadsheet versions prior to 2.1.1, upgrade to version 2.1.1 or later. For PHPSpreadsheet versions prior to 2.3.0, upgrade to version 2.3.0 or later. As a temporary workaround, consider forcing the parameters to be numerical values by using floatval() function for $ POST['A'], $ POST['B'], and $ POST['C'].

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-45060

GHSA-V66G-P9X6-V98P

Affected Products

Phpspreadsheet

References · 13

• 🔥 https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-v66g-p9x6-v98p · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45060.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-45060 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v66g-p9x6-v98p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45060 · Security Note
• https://github.com/PHPOffice/PhpSpreadsheet · Note
• https://github.com/PHPOffice/PhpSpreadsheet/commit/3990173db1207767139e63d33783beafada57007 · Note
• https://github.com/PHPOffice/PhpSpreadsheet/commit/bc74f3aa1d76f191c6c7c3631e286abb25c38759 · Note
• https://github.com/PHPOffice/PhpSpreadsheet/blob/d50b8b5de7e30439fb57eae7df9ea90e79fa0f2d/samples/Basic/45_Quadratic_equation_solver.php#L56 · Note
• https://github.com/PHPOffice/PhpSpreadsheet/commit/fb42a103f14cfce258c836b31f4a71f1fb1a9747 · Note
• https://twitter.com/VulmonFeeds/status/1843438352340504752 · Twitter Post
• https://t.me/cvedetector/7280 · Telegram Post
• https://twitter.com/CVEnew/status/1843390994563399915 · Twitter Post