CVE-2020-5299: October/backend Potential CSV Injection Vector Vulnerability

MODERATE
Advisory Identifier: GHSA-4rhm-m2fp-hx7q
Share
CVSS 4.0
CWE-77
Published
Advisory Summary

CVE-2020-5299 is a MODERATE (CVSS 4.0) potential csv injection vector vulnerability (CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')) affecting October/backend libraries in the Packagist ecosystem. The issue involves potential csv injection vector in octobercms. Remediation is available by upgrading affected packages to version 1.0.466.

CVE-2020-5299 at a Glance

CVE Identifier CVE-2020-5299
GHSA Identifier GHSA-4rhm-m2fp-hx7q
Severity MODERATE
CVSS v3.1 Base Score 4.0
CWE Classification CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected Product October/backend
Package Ecosystem Packagist
Published Date
Last Updated

Security Impact

CVSS: 4.0

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required High (PR:H)
User Interaction Required (UI:R)
Scope Changed (S:C)
Confidentiality Low (C:L)
Integrity Low (I:L)
Availability None (A:N)

How to Fix CVE-2020-5299

To remediate this vulnerability, upgrade all affected October/backend dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

october/backend fixed: 1.0.466 
Upgrade october/backend to 1.0.466
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for october/backend

How to Check if You Are Affected

To determine whether your application is affected by CVE-2020-5299, inspect your project dependencies for October/backend:

inspect dependencies for october/backend

Analyze the terminal output to locate any version of October/backend in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.0.466), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), where the product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. In October/backend, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Any users with the ability to modify any data that could eventually be exported as a CSV file from the `ImportExportController` could potentially introduce a CSV injection into the data to cause the generated CSV export file to be malicious. This requires attackers to achieve the following before a successful attack can be completed: 1. Have found a vulnerability in the victim's spreadsheet software of choice. 2. Control data that would potentially be exported through the `ImportExportController` by a theoretical victim. 3. Convince the victim to export above data as a CSV and run it in vulnerable spreadsheet software while also bypassing any sanity checks by said software. ### Patches Issue has been patched in Build 466 (v1.0.466). ### Workarounds Apply https://github.com/octobercms/library/commit/c84bf03f506052c848f2fddc05f24be631427a1a & https://github.com/octobercms/october/commit/802d8c8e09a2b342649393edb6d3ceb958851484 to your installation manually if unable to upgrade to Build 466. ### References Reported by @chrisvidal initially & [Sivanesh Ashok](https://stazot.com/) later. ### For more information If you have any questions or comments about this advisory: * Email us at [hello@octobercms.com](mailto:hello@octobercms.com) ### Threat assessment: Given the number of hoops that a potential attacker would have to jump through, this vulnerability really boils down to the possibility of abusing the trust that a user may have in the export functionality of the project. Thus, this has been rated low severity as it requires vulnerabilities to also exist in other software used by any potential victims as well as successful social engineering attacks.

CVE-2020-5299 Affected October/backend Versions

1 component(s)
Fixed Versions:
1.0.466
Product / Package Ecosystem Affected Versions Fixed Version
october/backend
 Packagist
≥ 1.0.319
< 1.0.466
1.0.466

References

GitHub Advisory / Wiki ADVISORY
https://github.com/octobercms/october/security/advisories/GHSA-4rhm-m2fp-hx7q
NVD — CVE-2020-5299 NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-5299
Security Fix Commit FIX COMMIT
https://github.com/octobercms/library/commit/c84bf03f506052c848f2fddc05f24be631427a1a
Security Fix Commit FIX COMMIT
https://github.com/octobercms/october/commit/802d8c8e09a2b342649393edb6d3ceb958851484
October/backend Security Information SECURITY
http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html
seclists.org/fulldisclosure/2020... WEB
http://seclists.org/fulldisclosure/2020/Aug/2

Frequently Asked Questions

What is CVE-2020-5299?
CVE-2020-5299 is a security vulnerability in October/backend involving Potential CSV Injection vector in OctoberCMS under CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection').
Which October/backend versions are affected?
Affected versions include releases prior to 1.0.466 across affected packages: october/backend.
What version fixes CVE-2020-5299?
Upgrading to 1.0.466 (or the latest patched release for your respective branch) resolves the vulnerability.
Is october/backend affected?
Yes, october/backend is affected in releases prior to 1.0.466. Upgrade your dependency to 1.0.466 or later.
What is the CVSS score of CVE-2020-5299?
CVE-2020-5299 has a CVSS v3.1 base score of 4.0 (MODERATE) with vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N.
What CWE is associated with CVE-2020-5299?
CVE-2020-5299 is classified under CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') (The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.).
How can I check Packagist dependencies for CVE-2020-5299?
Run the dependency tree command: 'inspect dependencies for october/backend'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-4rhm-m2fp-hx7q",
  "modified" : "2021-03-04T18:26:33Z",
  "published" : "2020-06-03T21:58:35Z",
  "aliases" : [ "CVE-2020-5299" ],
  "summary" : "Potential CSV Injection vector in OctoberCMS",
  "details" : "### Impact\nAny users with the ability to modify any data that could eventually be exported as a CSV file from the `ImportExportController` could potentially introduce a CSV injection into the data to cause the generated CSV export file to be malicious. This requires attackers to achieve the following before a successful attack can be completed: \n\n1. Have found a vulnerability in the victim's spreadsheet software of choice.\n2. Control data that would potentially be exported through the `ImportExportController` by a theoretical victim.\n3. Convince the victim to export above data as a CSV and run it in vulnerable spreadsheet software while also bypassing any sanity checks by said software.\n\n### Patches\nIssue has been patched in Build 466 (v1.0.466).\n\n### Workarounds\nApply https://github.com/octobercms/library/commit/c84bf03f506052c848f2fddc05f24be631427a1a & https://github.com/octobercms/october/commit/802d8c8e09a2b342649393edb6d3ceb958851484 to your installation manually if unable to upgrade to Build 466.\n\n### References\nReported by @chrisvidal initially & [Sivanesh Ashok](https://stazot.com/) later.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)\n\n### Threat assessment:\nGiven the number of hoops that a potential attacker would have to jump through, this vulnerability really boils down to the possibility of abusing the trust that a user may have in the export functionality of the project. Thus, this has been rated low severity as it requires vulnerabilities to also exist in other software used by any potential victims as well as successful social engineering attacks.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "october/backend"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.0.319"
      }, {
        "fixed" : "1.0.466"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/octobercms/october/security/advisories/GHSA-4rhm-m2fp-hx7q"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2020-5299"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/octobercms/library/commit/c84bf03f506052c848f2fddc05f24be631427a1a"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/octobercms/october/commit/802d8c8e09a2b342649393edb6d3ceb958851484"
  }, {
    "type" : "WEB",
    "url" : "http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html"
  }, {
    "type" : "WEB",
    "url" : "http://seclists.org/fulldisclosure/2020/Aug/2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-77" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2020-06-03T21:26:57Z",
    "nvd_published_at" : "2020-06-03T22:15:00Z"
  }
}