Potential CSV Injection vector in OctoberCMS
Impact
Any users with the ability to modify any data that could eventually be exported as a CSV file from the ImportExportController could potentially introduce a CSV injection into the data to cause the generated CSV export file to be malicious. This requires attackers to achieve the following before a successful attack can be completed:
- Have found a vulnerability in the victim's spreadsheet software of choice.
- Control data that would potentially be exported through the
ImportExportControllerby a theoretical victim. - Convince the victim to export above data as a CSV and run it in vulnerable spreadsheet software while also bypassing any sanity checks by said software.
Patches
Issue has been patched in Build 466 (v1.0.466).
Workarounds
Apply https://github.com/octobercms/library/commit/c84bf03f506052c848f2fddc05f24be631427a1a & https://github.com/octobercms/october/commit/802d8c8e09a2b342649393edb6d3ceb958851484 to your installation manually if unable to upgrade to Build 466.
References
Reported by @chrisvidal initially & Sivanesh Ashok later.
For more information
If you have any questions or comments about this advisory:
- Email us at hello@octobercms.com
Threat assessment:
Given the number of hoops that a potential attacker would have to jump through, this vulnerability really boils down to the possibility of abusing the trust that a user may have in the export functionality of the project. Thus, this has been rated low severity as it requires vulnerabilities to also exist in other software used by any potential victims as well as successful social engineering attacks.
Betroffene Software
Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.
| Plattform | Paket | Anfällige Versionen | Behoben in |
|---|---|---|---|
| Composer-Paket | october/backend | >= 1.0.319, < 1.0.466 | 1.0.466 |
Verweise
- https://github.com/octobercms/october/security/advisories/GHSA-4rhm-m2fp-hx7q
- https://nvd.nist.gov/vuln/detail/CVE-2020-5299
- https://github.com/octobercms/library/commit/c84bf03f506052c848f2fddc05f24be631427a1a
- https://github.com/octobercms/october/commit/802d8c8e09a2b342649393edb6d3ceb958851484
- http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html
- http://seclists.org/fulldisclosure/2020/Aug/2
- CVSS-Vektor
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N- Schwäche (CWE)
CWE-77- Plattform
- Composer
- Paket
october/backend- Veröffentlicht
- 03.06.2020
- Aktualisiert
- 11.10.2026 10:22
Quellen und Lizenzen
OSV / GitHub Advisory Database - GHSA-4rhm-m2fp-hx7q - CC BY 4.0
Schwachstellenhistorie: october/backend
Alle veröffentlichten Schwachstellen dieses Pakets (Composer-Paket), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.
- Einträge insgesamt
- 7
- Erste → letzte
- 06.2020 03.2021
- Ohne Fix
- 0
- In Angriffen ausgenutzt
- 0
Verteilung nach Schweregrad
- Mittel 2
- Niedrig 5
Veröffentlichungen pro Jahr
- 2020: 6
- 2021: 1
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
Potential CSV Injection vector in OctoberCMS dieser Eintrag
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.