Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS14aHZ2LTNqd3ctYzQ4N84AA4D6
ActiveAdmin CSV Injection leading to sensitive information disclosure
Impact
In ActiveAdmin versions prior to 3.2.0, maliciously crafted spreadsheet formulas could be uploaded as part of admin data that, when exported to a CSV file and the imported to a spreadsheet program like libreoffice, could lead to remote code execution and private data exfiltration.
The attacker would need privileges to upload data to the same ActiveAdmin application as the victim, and would need the victim to possibly ignore security warnings from their spreadsheet program.
Patches
Versions 3.2.0 and above fixed the problem by escaping any data starting with = and other characters used by spreadsheet programs.
Workarounds
Only turn on formula evaluation in spreadsheet programs when importing CSV after explicitly reviewing the file.
References
https://owasp.org/www-community/attacks/CSV_Injection
https://github.com/activeadmin/activeadmin/pull/8167
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14aHZ2LTNqd3ctYzQ4N84AA4D6
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 year ago
Updated: about 1 year ago
CVSS Score: 5.2
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
EPSS Percentage: 0.00137
EPSS Percentile: 0.49642
Identifiers: GHSA-xhvv-3jww-c487, CVE-2023-51763
References:
- https://github.com/activeadmin/activeadmin/security/advisories/GHSA-xhvv-3jww-c487
- https://nvd.nist.gov/vuln/detail/CVE-2023-51763
- https://github.com/activeadmin/activeadmin/pull/8167
- https://github.com/activeadmin/activeadmin/commit/7af735cf657c73734fca1900cd6a5adac4ee706e
- https://github.com/activeadmin/activeadmin/releases/tag/v3.2.0
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activeadmin/CVE-2023-51763.yml
- https://github.com/advisories/GHSA-xhvv-3jww-c487
Blast Radius: 21.9
Affected Packages
rubygems:activeadmin
Dependent packages: 192Dependent repositories: 16,473
Downloads: 37,045,555 total
Affected Version Ranges: < 3.2.0
Fixed in: 3.2.0
All affected versions: 0.1.0, 0.1.1, 0.2.0, 0.2.1, 0.2.2, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.4.0, 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.5.0, 0.5.1, 0.6.0, 0.6.1, 0.6.2, 0.6.3, 0.6.4, 0.6.5, 0.6.6, 1.0.0, 1.1.0, 1.2.0, 1.2.1, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.4.0, 2.5.0, 2.6.0, 2.6.1, 2.7.0, 2.8.0, 2.8.1, 2.9.0, 2.10.0, 2.10.1, 2.11.0, 2.11.1, 2.11.2, 2.12.0, 2.13.0, 2.13.1, 2.14.0, 3.0.0, 3.1.0
All unaffected versions: 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5