GHSA-r57h-547h-w24f PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters

• Packagist phpoffice/phpspreadsheet: >= 3.0.0, < 3.9.0 → fixed in 3.9.0 • Packagist phpoffice/phpspreadsheet: < 1.29.9 → fixed in 1.29.9 • Packagist phpoffice/phpspreadsheet: >= 2.2.0, < 2.3.7 → fixed in 2.3.7 • Packagist phpoffice/phpspreadsheet: >= 2.0.0, < 2.1.8 → fixed in 2.1.8 • Packagist phpoffice/phpexcel: <= 1.8.2 (no fix yet)

Product: PhpSpreadsheet Version: 3.8.0 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVSS vector v.3.1: 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) CVSS vector v.4.0: 4.8 (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) Description: an attacker can use special characters, so that the library processes the javascript protocol with special characters and generates an HTML link Impact: executing arbitrary JavaScript code in the browser Vulnerable component: class `PhpOffice\PhpSpreadsheet\Writer\Html`, method `generateRow` Exploitation conditions: a user viewing a specially generated xml file Mitigation: additional sanitization of special characters in a string Researcher: Igor Sak-Sakovskiy (Positive Technologies) Research The researcher discovered zero-day vulnerability Bypass XSS sanitizer using the javascript protocol and special characters in Phpspreadsheet. The following code is written on the server, which translates the XML file into an HTML representation and displays it in the response. *Listing 4. Source code on the server* ``` load($inputFileName); $writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet); print($writer->generateHTMLAll()); ``` The contents of the xml file - `./doc/file.xml` *Listing 5. The contents of the xml file* ``` author author 2015-06-05T18:19:34Z 2024-12-25T10:16:07Z 16.00 11020 19420 32767 32767 False False 1 3 6 False False ``` Due to the load with a special character in front of the javascript protocol, the execution flow hits line 1595, not 1593. *Figure 4. Generating a link bypassing a regular expression* In the response from the server, you can see which special character is located in front of the javascript protocol after conversion. *Figure 5. Response from the server with a special character* When viewing the rendered result, a link becomes visible in the browser, and when clicked, the embedded JavaScript code will be executed. *Figure 6. Executing JavaScript code* _____________________________________________ Credit Igor Sak-Sakovskiy (Positive Technologies)