9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.008 Low
EPSS
Percentile
79.9%
Hi consensys Security Team.
I have found CSV Injection when generate report at https://assets-paris-demo.codefi.network/
CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files.
When a spreadsheet program such as Microsoft Excel or LibreOffice Calc is used to open a CSV, any cells starting with = will be interpreted by the software as a formula. Maliciously crafted formulas can be used for three key attacks:
- Hijacking the userβs computer by exploiting vulnerabilities in the spreadsheet software, such as CVE-2014-3524.
- Hijacking the userβs computer by exploiting the userβs tendency to ignore security warnings in spreadsheets that they downloaded from their own website.
- Exfiltrating contents from the spreadsheet, or other open spreadsheets.
=cmd|' /C notepad'!'A1'
{F2002581}
##Similar valid reports at hackerone:-
Please let me know if need more info.
Best Regards.
@doosec101
This vulnerability can be harm for normal user because if malicious user injected any malicious script in token note and when customer user download CSV file then inserted command directly runs when CSV file open.
##FIX:-
Prefix =, +, - and @ symbols with a β in issues when exporting them to a .csv file.