CSV Formula Injection Vulnerability in phpLDAPadmin
Summary
DEBIAN-CVE-2024-9102: phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements th... Affects phpldapadmin versions 1.2.6.3-0.3 – 1.2.6.7-4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpLDAPadmin is a web-based application used for managing LDAP directories. It allows administrators to perform various operations on LDAP entries, including adding, modifying, and deleting records. The application is designed to provide a user-friendly interface for LDAP management. However, it has been identified that phpLDAPadmin versions from 1.2.0 to 1.2.6.7 are susceptible to a vulnerability that allows users to export LDAP directory elements into CSV files without proper sanitization, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from phpLDAPadmin's ability to export LDAP directory elements into CSV files without neutralizing special characters that could be interpreted as commands when opened in spreadsheet applications. This flaw can lead to CSV Formula Injection, where malicious users can craft CSV files that execute unintended commands when opened, potentially compromising the security of the system. The maintainer has stated that they do not intend to filter data on export, leaving this vulnerability unaddressed.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can manually inspect and sanitize any data before exporting it to CSV format. Avoid exporting sensitive or potentially harmful data that could be exploited through CSV Formula Injection.
Conclusion
The CSV Formula Injection vulnerability in phpLDAPadmin poses a significant risk to users who export LDAP data into CSV files. With no current patch available, it is crucial for administrators to be aware of this issue and take necessary precautions to mitigate potential risks.
See every vulnerability recorded for phpldapadmin →
FAQ
CSV Formula Injection is a vulnerability that occurs when a CSV file contains untrusted data that can be interpreted as a formula by spreadsheet applications, potentially leading to unintended command execution.
phpLDAPadmin versions from 1.2.0 to 1.2.6.7 are affected by this vulnerability.
No, the maintainer has stated that they will not address this vulnerability, and no patch is currently available.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
If you cannot update phpLDAPadmin, ensure that you sanitize any data before exporting it to CSV format and avoid exporting sensitive information.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpldapadmin.
