GHSA-79xx-vf93-p7cx Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet

• Packagist phpoffice/phpspreadsheet: >= 3.0.0, < 3.8.0 → fixed in 3.8.0 • Packagist phpoffice/phpspreadsheet: < 1.29.8 → fixed in 1.29.8 • Packagist phpoffice/phpspreadsheet: >= 2.0.0, < 2.1.7 → fixed in 2.1.7 • Packagist phpoffice/phpspreadsheet: >= 2.2.0, < 2.3.6 → fixed in 2.3.6 • Packagist phpoffice/phpexcel: <= 1.8.2 (no fix yet)

Summary The researcher discovered zero-day vulnerability Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response. Details When generating the HTML from an xlsx file containing multiple sheets, a navigation menu is created. This menu includes the sheet names, which are not sanitized. As a result, an attacker can exploit this vulnerability to execute JavaScript code. ```php // Construct HTML $html = ''; // Only if there are more than 1 sheets if (count($sheets) > 1) { // Loop all sheets $sheetId = 0; $html .= '' . PHP_EOL; foreach ($sheets as $sheet) { $html .= ' ' . $sheet->getTitle() . '' . PHP_EOL; ++$sheetId; } $html .= '' . PHP_EOL; } ``` PoC 1. Create an XLSX file with multiple sheets : 2. Generate the HTML content ```php writeAllSheets(); echo $writer->generateHTMLAll(); ?> ``` 3. Enjoy Impact XSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise. Example of impacts : • Disclosure of the user’s session cookie, allowing an attacker to hijack the user’s session and take over the account (Only if HttpOnly cookie's flag is set to false). • Redirecting the user to some other page or site (like phishing websites) • Modifying the content of the current page (add a fake login page that sends credentials to the attacker). • Automatically download malicious files. • Requests access to the victim geolocation / camera. • ...