Older versions of CSV-Safe gem doesn't filter out special characters which could trigger CSV Injection. (< 3.0.0) [CVE-2022-28481]

[danishtariqq]

Older versions of CSV-Safe gem doesn't filter out special characters which could trigger CSV Injection. (< 3.0.0)

Vulnerability Type
CSV Injection

Product
csv-safe

Affected Product Code Base
CSV-safe - <3.0.0 are effected

Affected Component
Sanitization of CSV Injection vectors.

Attack Type
Remote

Attack Vector
%0A-3+3+cmd|' /C calc'!D2 could be used to bypass CSV injection sanitizations in older versions.

Credits
Danish Tariq
Ali Hassan Ghori
Hassan Khan Yusufzai

Fixed by
Gabriel Rios - #8

References
https://github.com/zvory/csv-safe
#8
https://hackerone.com/reports/223999
WeblateOrg/weblate@d9e136f
https://bugzilla.mozilla.org/show_bug.cgi?id=1259881

[zvory]

Thank you.

[danishtariqq]

#8

[danishtariqq]

@zvory Can we claim CVE for this? i.e. Older version was not secured properly to filtrate enough characters against CSV Injection so was not fully securing and thus could be a cause of vulnerability in applications using older versions of csv-safe gem.

Steps needs to be done could be simply putting it in the Security advisory of your repository and adding details on why the newer version was created.

[zvory]

@danishtariqq Could you put up a PR?

[danishtariqq]

@danishtariqq Could you put up a PR?

#8 @zvory

[zvory]

@danishtariqq Oh sorry I meant for the CVE. I assumed that went into the repo. If it doesn't, feel free to make one! Sounds like a good idea.

[danishtariqq]

@zvory - #9