FD-56817 CSV Formula Injection: Fix & PoC for Location Scoping Report

Vulnerability Key Information Summary Vulnerability Overview Vulnerability ID: FD-56817 Vulnerability Type: CSV Formula Injection Description: Low-privilege users (e.g., ) can inject formulas (such as or into the CSV export of the Location Scoping report. When a high-privilege user (e.g., ) opens the CSV in Excel / LibreOffice / Google Sheets, the formulas are executed, which can lead to arbitrary code execution (XSS/command execution). Trigger Condition: Depends on the configuration item (formulas are automatically escaped when set to (default); when set to , formulas are output as-is without escaping). Scope of Impact Affected Files: - ( method) - (regression test) Affected Feature: CSV download of the Location Scoping report ( route). Affected Users: Low-privilege users who can edit Location records can plant formulas; high-privilege users (superuser) opening the CSV will trigger formula execution. Fix Details Introduced the helper class in , which decides whether to escape CSV fields based on : - When (default): Calls to escape each row's data, preventing formulas starting with from being interpreted and executed by Excel. - When : Outputs the raw data directly ( ). The response header is set to , and the file is returned via . POC / Exploit Code (Full Extraction) 1. Controller Fix Code (Key snippet from ) 2. Regression Test Code (Key snippet from ) 3. Typical Attack Payloads (POC) — Can trigger command execution on Windows — Formula summation, verifying that the formula is interpreted and executed by Excel — Simulates triggering a click event Notes Fix commit: (a child commit of ), author , branch , versions / . This fix covers the CSV export paths in both and , uniformly using for formula escaping.

Goal Reached Thanks to every supporter — we hit 100%!

FD-56817 CSV Formula Injection: Fix & PoC for Location Scoping Report

More from this source