Weblate: CSV Injection with the CSV export feature

Step to reproduce : 1.go to https://hosted.weblate.org/dictionaries/aptoide-uploader/bn/add 2.add "=1+1" to Source and Translation filed F178723 3.now do CSV export 4.you can see all the cell is displayed as "2" which means the code is executed. Best Regad's, Jay Patel...

Gratipay: CSV injection in gratipay.com via payment history export feature.

I discovered this issues thanks to Matt who pointed out that the participant's name is directly placed into a CSV file: https://github.com/gratipay/gratipay.com/issues/4399issuecomment-292250609 Summary --- Gratipay allows users to export payment history as a .csv file. By injecting a payload int...

Dropbox: CSV Injection with the CVS export feature

The report mentions a well known problem with any CSV export function. If the exported data has an Excel formula, the user will be warned and if the user clicks through a warning they might get some code execution. At the same time, fixing this bug means that the CSV data is no longer correct and...

GitLab: CSV injection in gitlab.com via issues export feature.

Dear GitLab bug bounty team, Summary --- GitLab allows users to export issues as a .csv file. By injecting a payload into an issue title an attacker could exfiltrate data or execute code on the target machine. For instance, by naming an issue =cmd|' /C calc'!A0 I am able to open up calc.exe on...

FullContact BB #2 - CSV Excel Macro Injection Vulnerability

Document Title: =============== FullContact BB 2 - CSV Excel Macro Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1904 Release Date: ============= 2017-01-19 Vulnerability Laboratory ID VL-ID: ====================================...

FullContact BB #2 - CSV Excel Macro Injection Vulnerability

Document Title: =============== FullContact BB 2 - CSV Excel Macro Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1904 Release Date: ============= 2017-01-19 Vulnerability Laboratory ID VL-ID: ====================================...

CampTix Event Ticketing <= 1.5.0 - CSV Injection Bypasses and XSS

The CampTix Event Ticketing WordPress plugin was affected by a CSV Injection Bypasses and XSS security vulnerability...

Ian Dunn: CSV Injection in Camptix

Hello, Ian! I see you tried to escape "=, -, +, @" in your code 151516, but let me show simple workaround. I've made CSV injection by using this string ";=cmd|' /C calc'!A5" without doublequotes. ";" will bypass your trying to set the quote in the beginning of the string. ";" acts as a new cell...

Ian Dunn: bypass to csv injection

Hi Ian, I would like to add payload to this report 151516. payload used: http://google.com?,=2+2-2+3+cmd|' /C calc'!G2 When injecting https://google.com? it will be rendered as a link but when comma , it will be rendered in a new cell which will execute the command. Thanks,...

Ian Dunn: Bypassing CSV injection using new line charcter

whitewalker reported that esccsv could be bypassed by using %0A-3+3+cmd|' /C calc'!D2 as the payload. For example, the firstname parameter in the following request: curl -ik 'https://2016.misc.wordcamp.dev/tickets/?tixaction=checkouttix' -H 'Host: 2016.misc.wordcamp.dev' -H 'User-Agent: Mozilla/5...

CampTix Event Ticketing <= 1.4.2 - CSV Injection and XSS

The CampTix Event Ticketing WordPress plugin was affected by a CSV Injection and XSS security vulnerability...

Ian Dunn: CSV Injection at Camptix Event Ticketing

Hi, As you mentioned the scope of vulnerability as Any plugin listed on my WordPress.org profile. I am reporting this issue. I have seen from your WordPress.org profile the second plugin listed is Camptix Event Ticketing So I looked at the source code of the plugin...

Pornhub: RCE Possible Via Video Manager Export using @ character in Video Title

The researcher identified that it was possible to inject arbitrary characters into video titles, that when exported via video manager would result in client-side code execution. The researcher was successful in getting a pingback from a meterpreter shell on the victim's machine. Essentially using...

Moneybird: CSV Injection with the CSV export feature

This researcher pointed at that is was possible to include formulas in the CSV export of Moneybird. Because these CSV files are interpreted by Excel, the formulas are executed on the clients computer. We are now filtering the input into the CSV export to prevent this behaviour...

New Relic: CSV Injection in sub_accounts.csv

As an admin of a company, I can set my company name to be something like "=1+1", which, when downloaded by me or anyone else with permission to access that file, will execute and show "2" in the excel file. While this may seem safe, I am able to make the name something more malicious, such as...

Uber: CSV Injection in business.uber.com

business.uber.com allows for names to begin with an = which allows for injection of formulas into the downloaded CSVs. I wasn't quite sure what to categorize this as since there are two main problems with allowing injection of formulas into a CSV: 1. It allows for data exfiltration through...

HackerOne: CSV Injection via the CSV export feature

I've bypassed 111192 by using this string ";=cmd|' /C calc'!A0" without doublequotes. Steps to reproduce are as in 111192. Tested in excel 2003-2013...

HackerOne: CSV Injection at the CSV export feature

Hi there, I have find a way to bypass the mitigation done in 72785 and 111192. What happens if an attacker creates a Ticket with the Tittle ":";-3+3+cmd|' /C calc'!D2. The ; will break the field making excel think that there are two fields. Although, you are using "" to encapsulate a field and , ...

HackerOne: CSV Injection via the CSV export feature

Hi , I have managed to bypass your fix for 72785 by submitting a report with NewLine character 0x0a in the title before the CSV formula. Steps to reproduce: 1. As a researcher , Submit a report to a program with the title %0A-2+3+cmd|' /C calc'!D2 , here is an example request: POST...

Shopify: CSV Excel Macro Injection Vulnerability in export list of current users - app.shopify.com

Hi , I have found that when a user tries to Export list of current users who installed his apps through: https://app.shopify.com/services/partners/apiclients//exportinstalledusers the fields of the CSV file are not properly escaped. which makes them vulnerable to CSV Excel Macro Injection...