Cloudanix VulnDB

CVE-2024-27756

None

CVSS

—

EPSS

0.7%

Published

Mar 15, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

Attackers who can name certain items in the system can slip in hidden commands that might run on someone's computer if they later open an exported list in a spreadsheet program.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Remote Code Execution
Component
Application
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw permits CSV injection when an attacker creates an asset using a crafted title containing spreadsheet formula payloads.

Why it matters to the business

Low-prevalence issue in an older component with stable low exploitation probability and no known ransomware use; successful abuse could lead to command execution on user workstations when exported data is opened in spreadsheet applications, creating limited operational risk.

How an attack unfolds

An attacker who can create assets supplies a title containing a CSV injection payload such as a formula that executes commands; when a privileged user later exports asset data to CSV and opens the file in spreadsheet software, the payload runs in the context of that user.

How to fix it

Upgrade the affected python3-flask package on AlmaLinux 8 to version 1:0.12.2-4.el8 or later; apply input validation or sanitization for asset titles prior to CSV export in GLPI deployments.

How to confirm the fix worked

Confirm the installed python3-flask package version meets or exceeds 1:0.12.2-4.el8; test asset title input containing formula characters to verify they are neutralized in exported CSV files.

Typical attack path

  1. Obtain permission to create an asset
  2. Submit asset creation request containing malicious formula in the title field
  3. Wait for or social-engineer a privileged user to export assets to CSV
  4. User opens the resulting CSV file in spreadsheet software triggering payload execution

How to detect it

Search application or web server logs for asset creation events containing formula characters such as equals signs or pipe symbols in title fields; review exported CSV files for suspicious leading formula content.

What your security team should do

  • Prioritize patching the listed AlmaLinux package within standard maintenance windows given low EPSS and absence from KEV
  • Review CSV export handling to ensure formula characters are escaped or prefixed
  • Monitor for any future EPSS increase or addition to threat intelligence feeds

The record

GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:16.04:LTS glpi 0 No fix
Ubuntu:Pro:16.04:LTS glpi 0 No fix

Related vulnerabilities