CVE-2024-45046
📋 TL;DR
This vulnerability in PHPSpreadsheet allows cross-site scripting (XSS) attacks through malicious spreadsheet files. When a user views a crafted spreadsheet as HTML, attackers can inject arbitrary JavaScript to hijack user sessions. This affects any application using PHPSpreadsheet to render spreadsheets as HTML.
💻 Affected Systems
- PHPSpreadsheet
📦 What is this software?
Phpspreadsheet by Phpoffice
Phpspreadsheet by Phpoffice
⚠️ Risk & Real-World Impact
Worst Case
Complete session takeover leading to account compromise, data theft, or further system access depending on user privileges.
Likely Case
Session hijacking leading to unauthorized access to user accounts and potential data exposure.
If Mitigated
Limited impact if proper input validation and output encoding are implemented elsewhere in the application.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious spreadsheet file, but no authentication is needed once the file is processed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.0
Vendor Advisory: https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6
Restart Required: No
Instructions:
1. Update PHPSpreadsheet via Composer: composer require phpoffice/phpspreadsheet:^2.1.0
2. Run composer update
3. Test that spreadsheet HTML rendering still works correctly
🔧 Temporary Workarounds
Disable HTML output
allAvoid using the Html writer component and use alternative output formats like PDF or direct download of spreadsheet files.
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to block inline JavaScript execution
- Validate and sanitize all user-uploaded spreadsheet files before processing
🔍 How to Verify
Check if Vulnerable:
Check composer.json or installed packages for PHPSpreadsheet version below 2.1.0Check Version:
composer show phpoffice/phpspreadsheet | grep versionsVerify Fix Applied:
Verify PHPSpreadsheet version is 2.1.0 or higher using composer show phpoffice/phpspreadsheet📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads with spreadsheet extensions
- Multiple failed HTML rendering attempts
- Suspicious user agent strings during file upload
Network Indicators:
- Unexpected JavaScript execution in spreadsheet viewing endpoints
- Suspicious file uploads to spreadsheet processing endpoints
SIEM Query:
source="web_server" AND (uri="*spreadsheet*" OR uri="*upload*") AND (status=200 OR status=500) AND (user_agent="*curl*" OR user_agent="*wget*")