CVE-2017-18049: SilverStripe CSV Excel Macro Injection
Summary
CVE-2017-18049: SilverStripe CSV Excel Macro Injection. Affects silverstripe/framework across 3 version ranges.
< 3.5.6
>= 3.6.0, < 3.6.3
>= 4.0.0, < 4.0.1
Fixed in 3.5.6, 3.6.3 or 4.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SilverStripe is an open-source content management system (CMS) framework written in PHP. It provides a flexible and extensible platform for building websites and web applications. The framework includes features for exporting data in CSV format. However, versions before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1 are vulnerable to CSV Excel Macro Injection. This vulnerability allows the exported CSV file to contain macros and scripts that can be executed when imported into software like Microsoft Excel. The issue arises from the lack of sanitization of user input in the 'First Name' field of a user's /myprofile page.
Vulnerability Detail
The CSV export feature in SilverStripe fails to properly sanitize user input, allowing the inclusion of malicious macros and scripts in the exported CSV file. When this file is opened in software like Microsoft Excel without proper sanitization, the macros and scripts can be executed, potentially leading to unauthorized code execution or other malicious activities. This vulnerability poses a moderate risk as it requires the user to open the CSV file in vulnerable software for the exploit to occur.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.5.63.5.6composer require silverstripe/framework:3.5.6 -
>= 3.6.0, < 3.6.33.6.3composer require silverstripe/framework:3.6.3 -
>= 4.0.0, < 4.0.14.0.1composer require silverstripe/framework:4.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually sanitize the exported CSV file before opening it in software like Microsoft Excel. This can be done by inspecting the file for any suspicious or unexpected content, such as macros or scripts, and removing them manually. However, this workaround is not recommended as it relies on manual inspection and may not be foolproof.
Conclusion
The CSV Excel Macro Injection vulnerability in SilverStripe allows the inclusion of malicious macros and scripts in exported CSV files. This can lead to unauthorized code execution or other malicious activities when opened in vulnerable software like Microsoft Excel. It is crucial to upgrade to the latest version of SilverStripe to fix this vulnerability and ensure the proper sanitization of user input in the CSV export feature. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
CSV Excel Macro Injection is a vulnerability that allows the inclusion of malicious macros and scripts in a CSV file. When the file is opened in software like Microsoft Excel without proper sanitization, these macros and scripts can be executed, potentially leading to unauthorized code execution or other malicious activities.
The impact of this vulnerability depends on the actions performed by the malicious macros or scripts included in the CSV file. It can range from unauthorized code execution to data theft or manipulation.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your SilverStripe installation is affected by this vulnerability. Simply provide your composer.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, patches are available for this vulnerability. It is recommended to upgrade to the latest version of SilverStripe, which includes the necessary fixes.
There are no known public exploits for this vulnerability at the time of writing. However, it is important to apply the necessary patches or upgrades to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
