{"id":23639,"date":"2024-10-30T10:00:37","date_gmt":"2024-10-30T09:00:37","guid":{"rendered":"https:\/\/herolab.usd.de\/security-advisories\/usd-2024-0007\/"},"modified":"2024-11-08T16:06:47","modified_gmt":"2024-11-08T15:06:47","slug":"usd-2024-0007","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2024-0007\/","title":{"rendered":"usd-2024-0007"},"content":{"rendered":"<p>[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.25.2\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.27.2\" _module_preset=\"default\" custom_padding=\"||13px|||\" global_colors_info=\"{}\"]<\/p>\n<h1>usd-2024-0007 | CSV Injection in Jira Cloud<\/h1>\n<h1><\/h1>\n<p><strong>Advisory ID<\/strong>: usd-2024-0007<br \/><strong>Product<\/strong>: Jira Cloud<br \/><strong>Affected Version<\/strong>: v1001.0.0-SNAPSHOT#100247 (and prior versions)<br \/><strong>Vulnerability Type<\/strong>: Improper Neutralization of Formula Elements in a CSV File (CWE 1236)<br \/><strong>Security Risk<\/strong>: HIGH<br \/>(CVSS 3.1: 8.0 - AV:N\/AC:L\/PR:L\/UI:R\/S:U\/C:H\/I:H\/A:H) (CVSS 4.0: 8.5 - AV:N\/AC:L\/AT:N\/PR:L\/UI:A\/VC:H\/VI:H\/VA:H\/SC:N\/SI:N\/SA:N)<br \/><strong>Vendor URL<\/strong>: <a href=\"https:\/\/www.atlassian.com\" target=\"_blank\" rel=\"noopener\">https:\/\/www.atlassian.com\/<\/a><br \/><strong>Vendor acknowledged vulnerability<\/strong>: Yes<br \/><strong>Vendor Status<\/strong>: Closed as Finding was deemed 'Informational'<br \/><strong>CVE Number<\/strong>: Not Assigned<\/p>\n<h3>Desciption<\/h3>\n<p><em>Jira Cloud<\/em> by <em>Atlassian<\/em> is a web-based tool for bug and issue tracking and agile project management. According to the vendor's website, over 100,000 customers worldwide use <em>Jira<\/em>.<\/p>\n<p><em>Jira Cloud<\/em> is affected by a CSV injection vulnerability, potentially leading to the execution of arbitrary code via a crafted Excel file. A low-privileged remote attacker can create <em>Jira<\/em> issues containing the malicious payload that will be included in the exported CSV file.<\/p>\n<h3>Proof of Concept<\/h3>\n<p>Low-privileged users can create <em>Jira<\/em> issues containing spreadsheet formulas in the <strong>summary<\/strong> field that becomes the title of the issue:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2024\/10\/jira_issue_csv_injection-300x133.png\" width=\"300\" height=\"133\" alt=\"\" class=\"wp-image-23466 alignnone size-medium\" srcset=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2024\/10\/jira_issue_csv_injection-300x133.png 300w, https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2024\/10\/jira_issue_csv_injection-400x177.png 400w, https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2024\/10\/jira_issue_csv_injection.png 427w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/p>\n<p><em>Jira<\/em> issues can be exported in various formats, including CSV. The excerpt of the exported CSV file below shows that the injected formula <strong>=cmd|'\/c calc'!A0<\/strong> is not properly sanitized:<\/p>\n<pre class=\"codehilite\" style=\"line-height: 125%;background: #263238;color: #eff\">## Summary,Issue key,Issue id,Issue Type,Status,Project key,Project name,[...]<br \/>cmd|'\/c calc'!A0,UAP2-1,44279,Task,To Do,UAP2,usd AG Pentest 2024,[...]<\/pre>\n<p>Opening the file in Microsoft Excel leads to the execution of the formula that will invoke the calculator application as a proof of concept, if Excel is configured to allow data connections or if the user confirms the corresponding warning message:<br \/><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2024\/10\/execute_formula-300x250.png\" width=\"300\" height=\"250\" alt=\"\" class=\"wp-image-23464 alignnone size-medium\" \/><\/p>\n<h3>Fix<\/h3>\n<p>Where possible, the set of allowed characters for user input should be restricted using an allowlist.<br \/>Additionally, in the generation of spreadsheets, such CSV files, the following sanitization rules should be applied:<\/p>\n<ul>\n<li>every cell starting with an equal (<strong>=<\/strong>), plus (<strong>+<\/strong>), minus (<strong>-<\/strong>) or at-sign (<strong>@<\/strong>) should be prepended by a single quote (<strong>'<\/strong>) and embedded in double quotes (<strong>\"<\/strong>)<\/li>\n<li>every cell containing a comma (<strong>,<\/strong>) or semicolon (<strong>;<\/strong>) should be prepended by a single quote (<strong>'<\/strong>) and embedded in double quotes (<strong>\"<\/strong>)<\/li>\n<li>every double quote (<strong>\"<\/strong>) in a cell's content should be escaped by another double quote (<strong>\"<\/strong>)<\/li>\n<\/ul>\n<h3>References<\/h3>\n<ul>\n<li><a href=\"https:\/\/owasp.org\/www-community\/attacks\/CSV_Injection\" target=\"_blank\" rel=\"noopener\">https:\/\/owasp.org\/www-community\/attacks\/CSV_Injection<\/a><\/li>\n<\/ul>\n<h3>Timeline<\/h3>\n<ul>\n<li><strong>2024-03-18<\/strong>: Vulnerability disclosed via security@atlassian.com.<\/li>\n<li><strong>2024-03-20<\/strong>: Re-submission of the Finding via <a href=\"https:\/\/www.bugcrowd.com\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.bugcrowd.com\/.<\/a><\/li>\n<li><strong>2024-04-22<\/strong>: Report closed and classified informational.<\/li>\n<\/ul>\n<h3>Credits<\/h3>\n<p>This security vulnerability was identified by Dominique Dittert and Markus Arnold of usd AG.<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>usd-2024-0007 | CSV Injection in Jira Cloud Advisory ID: usd-2024-0007Product: Jira CloudAffected Version: v1001.0.0-SNAPSHOT#100247 (and prior versions)Vulnerability Type: Improper Neutralization of Formula Elements in a CSV File (CWE 1236)Security Risk: HIGH(CVSS 3.1: 8.0 - AV:N\/AC:L\/PR:L\/UI:R\/S:U\/C:H\/I:H\/A:H) (CVSS 4.0: 8.5 - AV:N\/AC:L\/AT:N\/PR:L\/UI:A\/VC:H\/VI:H\/VA:H\/SC:N\/SI:N\/SA:N)Vendor URL: https:\/\/www.atlassian.com\/Vendor acknowledged vulnerability: YesVendor Status: Closed as Finding was deemed 'Informational'CVE Number: Not Assigned [&hellip;]<\/p>\n","protected":false},"author":114,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-23639","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/23639","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/114"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=23639"}],"version-history":[{"count":3,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/23639\/revisions"}],"predecessor-version":[{"id":23642,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/23639\/revisions\/23642"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=23639"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}