CVE-2021-38180 - Improper Neutralization of Formula Elements in a CSV File

Severity

98%

Complexity

39%

Confidentiality

98%

SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitation during the data export. An attacker could thereby execute arbitrary commands on the victim's computer but only if the victim allows to execute macros while opening the file and the security settings of Excel allow for command execution.

CVSS 3.1 Base Score 9.8. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS 2.0 Base Score 9.3. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C).

Demo Examples

Improper Neutralization of Formula Elements in a CSV File

CWE-1236

Hyperlinks or other commands can be executed when a cell begins with the formula identifier, '='


                    
=HYPERLINK(link_location, [friendly_name])

Stripping the leading equals sign, or simply not executing formulas from untrusted sources, impedes malicious activity.


                    
HYPERLINK(link_location, [friendly_name])

Overview

First reported 3 years ago

2021-10-12 15:15:00

Last updated 3 years ago

2021-10-19 00:47:00

Affected Software

SAP Business One 10.0

10.0

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983

https://launchpad.support.sap.com/#/notes/3079427

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983

Vendor Advisory

https://launchpad.support.sap.com/#/notes/3079427

Permissions Required

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.