9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.8 High
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
27.5%
In ActiveAdmin versions prior to 3.2.0, maliciously crafted spreadsheet formulas could be uploaded as part of admin data that, when exported to a CSV file and the imported to a spreadsheet program like libreoffice, could lead to remote code execution and private data exfiltration.
The attacker would need privileges to upload data to the same ActiveAdmin application as the victim, and would need the victim to possibly ignore security warnings from their spreadsheet program.
Versions 3.2.0 and above fixed the problem by escaping any data starting with =
and other characters used by spreadsheet programs.
Only turn on formula evaluation in spreadsheet programs when importing CSV after explicitly reviewing the file.
https://owasp.org/www-community/attacks/CSV_Injection
https://github.com/activeadmin/activeadmin/pull/8167
github.com/activeadmin/activeadmin
github.com/activeadmin/activeadmin/commit/7af735cf657c73734fca1900cd6a5adac4ee706e
github.com/activeadmin/activeadmin/pull/8167
github.com/activeadmin/activeadmin/releases/tag/v3.2.0
github.com/activeadmin/activeadmin/security/advisories/GHSA-xhvv-3jww-c487
github.com/rubysec/ruby-advisory-db/blob/master/gems/activeadmin/CVE-2023-51763.yml
nvd.nist.gov/vuln/detail/CVE-2023-51763
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.8 High
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
27.5%