CVE-2024-56411
📋 TL;DR
PhpSpreadsheet versions before 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting vulnerability in the HTML page header's hyperlink base. Attackers can inject malicious scripts that execute when users view generated HTML pages. This affects any PHP application using vulnerable PhpSpreadsheet versions to generate HTML output.
💻 Affected Systems
- PHPOffice/PhpSpreadsheet
📦 What is this software?
Phpspreadsheet by Phpoffice
Phpspreadsheet by Phpoffice
Phpspreadsheet by Phpoffice
Phpspreadsheet by Phpoffice
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal session cookies, credentials, or perform actions as authenticated users when victims view maliciously crafted HTML output.
Likely Case
Limited XSS attacks against users who view HTML output from PhpSpreadsheet, potentially leading to session hijacking or credential theft.
If Mitigated
No impact if proper output encoding is applied or if HTML output isn't used.
🎯 Exploit Status
Exploitation requires attacker to control hyperlink base input and victim to view resulting HTML.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.7.0, 2.3.5, 2.1.6, or 1.29.7
Vendor Advisory: https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hwcp-2h35-p66w
Restart Required: No
Instructions:
1. Identify your PhpSpreadsheet version. 2. Update via Composer: composer require phpoffice/phpspreadsheet:^3.7.0 (or appropriate version). 3. Test HTML generation functionality.
🔧 Temporary Workarounds
Disable HTML Output
allAvoid using PhpSpreadsheet's HTML writer if possible.
Manual Sanitization
allManually sanitize hyperlink base input before passing to PhpSpreadsheet.
🧯 If You Can't Patch
- Implement Content Security Policy headers to restrict script execution.
- Use output encoding on all user-controlled data in HTML context.
🔍 How to Verify
Check if Vulnerable:
Check composer.json or run: composer show phpoffice/phpspreadsheet | grep versionCheck Version:
composer show phpoffice/phpspreadsheet | grep versionVerify Fix Applied:
Verify version is 3.7.0+, 2.3.5+, 2.1.6+, or 1.29.7+📡 Detection & Monitoring
Log Indicators:
- Unusual HTML generation errors
- Suspicious hyperlink base values in logs
Network Indicators:
- HTML responses containing script tags in hyperlink attributes
SIEM Query:
Search for HTML responses containing 'javascript:' in href attributes from spreadsheet generation endpoints.