GHSA-xhvv-3jww-c487

Suggest an improvement
Source
https://github.com/advisories/GHSA-xhvv-3jww-c487
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-xhvv-3jww-c487/GHSA-xhvv-3jww-c487.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-xhvv-3jww-c487
Aliases
Published
2023-12-28T18:45:30Z
Modified
2024-02-16T07:59:26.143251Z
Severity
  • 5.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L CVSS Calculator
Summary
ActiveAdmin CSV Injection leading to sensitive information disclosure
Details

Impact

In ActiveAdmin versions prior to 3.2.0, maliciously crafted spreadsheet formulas could be uploaded as part of admin data that, when exported to a CSV file and the imported to a spreadsheet program like libreoffice, could lead to remote code execution and private data exfiltration.

The attacker would need privileges to upload data to the same ActiveAdmin application as the victim, and would need the victim to possibly ignore security warnings from their spreadsheet program.

Patches

Versions 3.2.0 and above fixed the problem by escaping any data starting with = and other characters used by spreadsheet programs.

Workarounds

Only turn on formula evaluation in spreadsheet programs when importing CSV after explicitly reviewing the file.

References

https://owasp.org/www-community/attacks/CSV_Injection https://github.com/activeadmin/activeadmin/pull/8167

Database specific 
{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-1236"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-28T18:45:30Z"
}
References

Affected packages

RubyGems / activeadmin

Package

Name
activeadmin
Purl
pkg:gem/activeadmin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.0

Affected versions

0.*

0.1.0
0.1.1
0.2.0
0.2.1
0.2.2
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.5.0.pre
0.5.0.pre1
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6

1.*

1.0.0.pre1
1.0.0.pre2
1.0.0.pre3
1.0.0.pre4
1.0.0.pre5
1.0.0
1.1.0
1.2.0
1.2.1
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3

2.*

2.0.0.rc1
2.0.0.rc2
2.0.0
2.1.0
2.2.0
2.3.0
2.3.1
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.8.1
2.9.0
2.10.0
2.10.1
2.11.0
2.11.1
2.11.2
2.12.0
2.13.0
2.13.1
2.14.0

3.*

3.0.0
3.1.0