Impact

• All CSV Exports contain a CSV Injection Vulnerability
  • BAG MED Exports
  • Statistics Exports

Exploit

• A user enters a malicious formula into one of the exported fields
• Another user exports the data
• Opens the file with an editor like Excel
• The malicious formula is executed

This vulnerability has been discovered at a penetration test. It has not been exploited.

Patches

• d917f27
• beatrichartz/csv#104

Workarounds

None

References

• https://owasp.org/www-community/attacks/CSV_Injection

For more information

If you have any questions or comments about this advisory:

• Open an issue in hygeia
• Email us at maennchen@joshmartin.ch