CSV Injection Vulnerability

[Acid]

BPO	26399
Nosy	@brettcannon, @soltysh

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2016-02-23.10:21:39.989>
created_at = <Date 2016-02-21.10:45:20.453>
labels = []
title = 'CSV Injection Vulnerability'
updated_at = <Date 2016-02-23.10:21:39.987>
user = 'https://bugs.python.org/Acid'

bugs.python.org fields:

activity = <Date 2016-02-23.10:21:39.987>
actor = 'maciej.szulik'
assignee = 'none'
closed = True
closed_date = <Date 2016-02-23.10:21:39.989>
closer = 'maciej.szulik'
components = []
creation = <Date 2016-02-21.10:45:20.453>
creator = 'Acid'
dependencies = []
files = []
hgrepos = []
issue_num = 26399
keywords = []
message_count = 4.0
messages = ['260602', '260603', '260624', '260724']
nosy_count = 3.0
nosy_names = ['brett.cannon', 'maciej.szulik', 'Acid']
pr_nums = []
priority = 'normal'
resolution = 'wont fix'
stage = None
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue26399'
versions = []

[Acid]

The "Download as CSV " feature of bugs.python.org does not properly "escape" fields. This allows an adversary to turn a field into active content so when we download the csv and opens it, the active content gets executed. Here is more information about this issue:
http://www.contextis.com/resources/blog/comma-separated-vulnerabilities/

Steps to Reproduce.

1. Enter the title with the payload : -2+3+cmd|' /C calc'!A0
2. Download the bugs as CSV
3. Open it with excel and Calc will get prompted.

Depending upon the system user privileges, an attacker can perform various tasks using the same.
If the user is with high privilege, it is easy to change the system password as mentioned below
-2+3+cmd|' /C net user administrator lol@123'!A0

Mitigations:
Ensure all fields are properly "escaped" before returning the CSV file to the user.

Regards,
Acid

[Acid]

Impact of this one is high, as download as CSV is present for guest user as well. Means anyone can download the bugs using "Download as CSV " function and as the file is downloaded from the trusted resource so the possibility is high the code will get executed.

[brettcannon]

Tracker bugs should be reported to http://psf.upfronthosting.co.za/roundup/meta/ .

[soltysh]

Closing in favor of http://psf.upfronthosting.co.za/roundup/meta/issue580