CVE-2023-2629: Formula Injection/CSV Injection in pimcore/customer-management-framework-bundle
Summary
CVE-2023-2629: Embedding untrusted input inside CSV files leads to Formula Injection/CSV Injection. Affects pimcore/customer-management-framework-bundle versions < 3.3.9. Fixed in 3.3.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pimcore/customer-management-framework-bundle is a package available on Packagist. It is a component of the Pimcore application, which is used for customer management. The bundle provides functionality for managing customer data, including fields such as Firstname, Lastname, Street, Zip, and City. Unfortunately, this package is vulnerable to Formula Injection/CSV Injection, which allows unauthenticated attackers to execute arbitrary code via a crafted Excel file.
Vulnerability Detail
The vulnerability in pimcore/customer-management-framework-bundle arises from the insecure handling of untrusted input inside CSV files. Specifically, the Firstname, Lastname, Street, Zip, and City input fields are susceptible to Formula Injection/CSV Injection. This vulnerability can be exploited by an attacker to execute arbitrary code, leading to potential impacts such as client-side command injection, code execution, or remote exfiltration of confidential data. The CVSS score for this vulnerability is 7.8.
How To Fix
Minimum fixed version
3.3.9
This is the first release that contains the fix.
composer require pimcore/customer-management-framework-bundle:3.3.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating or applying the patch is not immediately feasible, you can apply the patch manually by following the instructions in the provided patch file: https://github.com/pimcore/customer-data-framework/commit/4e0105c3a78d20686a0c010faef27d2297b98803.patch
Conclusion
The pimcore/customer-management-framework-bundle package is vulnerable to Formula Injection/CSV Injection, which can be exploited by unauthenticated attackers to execute arbitrary code. It is crucial to update to version 3.3.9 or apply the provided patch to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for pimcore/customer-management-framework-bundle →
FAQ
This vulnerability allows unauthenticated attackers to execute arbitrary code via a crafted Excel file. Successful exploitation can lead to client-side command injection, code execution, or remote exfiltration of confidential data.
You can fix this vulnerability by updating the pimcore/customer-management-framework-bundle to version 3.3.9 or manually applying the provided patch.
Yes, if updating or applying the patch is not immediately feasible, you can manually apply the patch by following the instructions in the provided patch file.
You can find more information about this vulnerability in the following references: - Advisory: https://huntr.dev/bounties/821ff465-4754-42d1-9376-813c17f16a01/ - GitHub Advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-mq3x-qgwx-3rfw/GHSA-mq3x-qgwx-3rfw.json
Yes, the CVSS score for this vulnerability is 7.8.
References
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/customer-management-framework-bundle.
