{"action":"closed","issue":{"url":"https://api.github.com/repos/splitbrain/dokuwiki/issues/2450","repository_url":"https://api.github.com/repos/splitbrain/dokuwiki","labels_url":"https://api.github.com/repos/splitbrain/dokuwiki/issues/2450/labels{/name}","comments_url":"https://api.github.com/repos/splitbrain/dokuwiki/issues/2450/comments","events_url":"https://api.github.com/repos/splitbrain/dokuwiki/issues/2450/events","html_url":"https://github.com/splitbrain/dokuwiki/issues/2450","id":342833363,"node_id":"MDU6SXNzdWUzNDI4MzMzNjM=","number":2450,"title":" CSV Formula Injection vulnerability","user":{"login":"splitbrain","id":86426,"node_id":"MDQ6VXNlcjg2NDI2","avatar_url":"https://avatars1.githubusercontent.com/u/86426?v=4","gravatar_id":"","url":"https://api.github.com/users/splitbrain","html_url":"https://github.com/splitbrain","followers_url":"https://api.github.com/users/splitbrain/followers","following_url":"https://api.github.com/users/splitbrain/following{/other_user}","gists_url":"https://api.github.com/users/splitbrain/gists{/gist_id}","starred_url":"https://api.github.com/users/splitbrain/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/splitbrain/subscriptions","organizations_url":"https://api.github.com/users/splitbrain/orgs","repos_url":"https://api.github.com/users/splitbrain/repos","events_url":"https://api.github.com/users/splitbrain/events{/privacy}","received_events_url":"https://api.github.com/users/splitbrain/received_events","type":"User","site_admin":false},"labels":[{"id":212556768,"node_id":"MDU6TGFiZWwyMTI1NTY3Njg=","url":"https://api.github.com/repos/splitbrain/dokuwiki/labels/Security","name":"Security","color":"e11d21","default":false},{"id":212561755,"node_id":"MDU6TGFiZWwyMTI1NjE3NTU=","url":"https://api.github.com/repos/splitbrain/dokuwiki/labels/Severity:%20Small","name":"Severity: Small","color":"FAD6C4","default":false},{"id":212557849,"node_id":"MDU6TGFiZWwyMTI1NTc4NDk=","url":"https://api.github.com/repos/splitbrain/dokuwiki/labels/won't%20fix","name":"won't fix","color":"D2DAE1","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-07-19T18:07:14Z","updated_at":"2018-08-17T08:53:04Z","closed_at":"2018-08-17T08:53:04Z","author_association":"OWNER","body":"The following was reported directly to me by Jean-Benjamin Rousseau from SEC Consult (Schweiz) AG\r\n\r\n# Vulnerability overview/description:\r\n\r\nThe administration panel of the application has a \"CSV export of users\" feature which allows the export of user data (username, real name, email address and user groups) as a CSV file. On the registration page, it is possible for an attacker to set certain values in the Real Name field that - when exported and opened with a spreadsheet application (Microsoft Excel, Open Office, etc.) - will be interpreted as a formula. \r\nThis puts the administrators who open those malicious exported files at risk. Exfiltration of sensitive data or even the execution of arbitrary code on the local machine of the victim will be the result. The final impact depends on the used spreadsheet software on the client of the victim.\r\n\r\n# Proof of concept:\r\n\r\nRegistration URL:\r\n    http://www.example.com/doku.php?id=start&do=register\r\n\r\nWhen the registration request is submitted, the following parameters are sent in a POST request:\r\n````\r\nsectok=&do=register&save=1&login=login_parameter&fullname=evil_csv_formula_injection_payload&email=email_address\r\n````\r\n\r\nThe \"fullname\" parameter is not sanitized before being stored and during the CSV export. An attacker can inject different CSV formula payloads in the fullname parameter.\r\n\r\nFor example:\r\n\r\n    =cmd|'/C calc'!A0\r\n\r\nAs soon as the file gets opened in Microsoft Excel, the program calc.exe is launched. Different warnings might pop up. However, these warnings are usually ignored because the file comes from a trusted source.\r\n"}}
{"actor":{"display_login":"splitbrain"}}