Cross-site Scripting in PHPOffice/PhpSpreadsheet

bounties/packagist/phpoffice/phpspreadsheet/1/README.md

@@ -0,0 +1,33 @@
+# Overview
+
+`PHPOffice/PhpSpreadsheet` is a library written in pure PHP and offers a set of classes that allow you to read and write various spreadsheet file formats such as Excel and LibreOffice Calc.
+
+This Package is vulnerable to Cross-site Scripting when creating an html output from excel file.
+
+# POC
+
+1. Setup Project
+2. Create an excel file -> Insert Comment -> Insert Payload `<script>alert(1)</script>`
+3. Move the file to the project dir
+4. Create a php file with filename `convert-excel-to-html.php` -> Insert code below
+```
+<?php
+
+require './vendor/autoload.php';
+
+use PhpOffice\PhpSpreadsheet\IOFactory;
+
+$filename = 'INSERT_YOUR_EXCEL_FILE_HERE';
+
+$spreadsheet = IOFactory::load('./'.$filename);
+$writer = IOFactory::createWriter($spreadsheet, 'Html');
+
+$filename = 'testxss.html';
+$writer->save($filename);
+```
+5. Open Project dir in terminal -> run command `php convert-excel-to-html.php`
+6. `testxss.html` html file will be generated in project root dir
+7. Open generated html file with filename `testxss.html`on Browser
+8. Verify that the payload will be triggered
+
+

bounties/packagist/phpoffice/phpspreadsheet/1/vulnerability.json

@@ -0,0 +1,52 @@
+{
+    "PackageVulnerabilityID": "1",
+    "DisclosureDate": "2020-11-07",
+    "AffectedVersionRange": "*",
+    "Summary": "Cross-site Scripting",
+    "Contributor": {
+        "Discloser": "nikkolai14",
+        "Fixer": ""
+    },
+    "Package": {
+        "Registry": "packagist",
+        "Name": "phpoffice/phpspreadsheet",
+        "URL": "https://packagist.org/packages/phpoffice/phpspreadsheet"
+    },
+    "CWEs": [
+        {
+            "ID": "79",
+            "Description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+        }
+    ],
+    "CVSS": {
+        "Version": "3.1",
+        "AV": "L",
+        "AC": "L",
+        "PR": "N",
+        "UI": "R",
+        "S": "U",
+        "C": "L",
+        "I": "N",
+        "A": "N",
+        "E": "X",
+        "RL": "X",
+        "RC": "X",
+        "Score": "3.3"
+    },
+    "CVEs": [
+        ""
+    ],
+    "Repository": {
+        "URL": "https://github.com/PHPOffice/PhpSpreadsheet",
+        "Codebase": [
+            "PHP"
+        ]
+    },
+    "Permalinks": ["https://github.com/PHPOffice/PhpSpreadsheet/blob/master/src/PhpSpreadsheet/Writer/Html.php#L1792"],
+    "References": [
+        {
+            "Description": "",
+            "URL": ""
+        }
+    ]
+}