Executive brief
jspreadsheet is a popular JavaScript library for creating interactive spreadsheet interfaces in web applications. The dropdown menu feature failed to properly sanitize user-supplied content, allowing attackers to inject malicious scripts that execute in the context of any user viewing the spreadsheet. This could lead to session hijacking, credential theft, or malware distribution to end users.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw in the dropdown menu component of jspreadsheet-ce prior to version 4.6.0. The dropdown menu accepts data from the source array without proper HTML encoding or sanitization, allowing attackers to inject arbitrary JavaScript through crafted dropdown option values. The attack requires user interaction (double-clicking the dropdown cell to edit it) and is triggered when the malicious content is rendered. Attackers can achieve session hijacking, credential theft, or malware distribution targeting users who view the spreadsheet. The vulnerability was patched in version 4.6.0.
Affected products
- jspreadsheet jspreadsheet-ce before 4.6.0
Timeline
- 2022-12-23: disclosed: Vulnerability reported on GitHub issue #1587
- 2023-02-17: advisory
- 2023-02-18: patched: Fixed in version 4.6.0