CVE-2022-2027: CSV Injection in kromitgmbh/titra
CVE ID: CVE-2022-2027
Date: June 9, 2022
Severity: High (CVSS 3.1: 8.0)
CWE: CWE-1236 — Improper Neutralization of Formula Elements in a CSV File
Affected: kromitgmbh/titra prior to 0.77.0
Fixed in: 0.77.0
🔍 Overview
kromitgmbh/titra prior to 0.77.0 improperly neutralizes formula elements in CSV files. When data is exported to CSV and opened in spreadsheet applications (e.g., Microsoft Excel, LibreOffice Calc), malicious formulas embedded in the data can be executed on the user’s machine.
This is commonly known as CSV Injection or Formula Injection.
CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector: Network, low complexity, low privileges, user interaction required, unchanged scope.
🎯 Impact
An attacker who can influence data that gets exported to CSV can embed formulas (e.g., =HYPERLINK, =CMD, =MSEXEC) that execute when a victim opens the CSV file in a vulnerable spreadsheet application. This can lead to:
- Arbitrary command execution on the victim’s workstation
- Data exfiltration from the victim’s machine
- Credential harvesting
🛡️ Mitigation
Upgrade to titra 0.77.0 or later. When generating CSV exports:
- Prefix fields starting with
=,+,-,@, or tab with a single quote (') - Sanitize or escape formula elements before writing CSV output
- Warn users not to enable macros or content in untrusted CSV files