PT-2024-9826 · Unknown · Simplexlsx

Aleksey Solovev · Published 2024-12-17 · Updated 2024-12-23 · CVE-2024-56364

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SimpleXLSX versions 1.0.12 through 1.1.13

Description: The issue is related to the execution of arbitrary JavaScript code when calling the extended toHTMLEx method in SimpleXLSX. This can allow a remote attacker to execute arbitrary JavaScript code. The vulnerability is associated with the lack of protection measures for the web page structure.

Recommendations: For SimpleXLSX versions 1.0.12 through 1.1.12, update to version 1.1.13 to resolve the issue. As a temporary workaround, consider avoiding the use of the toHTMLEx method until the issue is resolved. Do not use data publication via toHTMLEx until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-11603

CVE-2024-56364

GHSA-R87Q-FJ25-F8JF

Affected Products

Simplexlsx

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56364.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-56364 · Security Note
• https://bdu.fstec.ru/vul/2024-11603 · Security Note
• https://osv.dev/vulnerability/GHSA-r87q-fj25-f8jf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-56364 · Vendor Advisory
• https://github.com/shuchkin/simplexlsx/commit/71a5e3d40d14e33161f8a40b3fd02de542218ef0 · Note
• https://github.com/shuchkin/simplexlsx/security/advisories/GHSA-r87q-fj25-f8jf · Note
• https://github.com/shuchkin/simplexlsx · Note
• https://twitter.com/CVEnew/status/1871228341711188258 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1871241758731845744 · Twitter Post
• https://t.me/cvedetector/13539 · Telegram Post