CVE-2024-9102

What it actually does

The application exports LDAP directory data to CSV without sanitizing special characters that spreadsheet applications interpret as formulas, enabling CSV formula injection.

Why it matters to the business

Users opening exported files in spreadsheet software may trigger unintended command execution or data exfiltration, increasing risk of follow-on compromise; the issue remains unaddressed by maintainers, requiring organizations to implement their own controls.

How an attack unfolds

An attacker with write access to the LDAP directory places formula payloads into attribute values; an administrator later exports the data to CSV via phpLDAPadmin; when the recipient opens the file in a spreadsheet product the formulas execute, potentially running commands or leaking data.

How to fix it

Apply the fix from commit ea17aadef46fd29850160987fe7740ceed1381ad in the leenooks/phpldapadmin repository; alternatively, implement output sanitization that prefixes cells containing formula characters with a single quote or neutral character before CSV generation.

How to confirm the fix worked

Confirm the presence of the commit ea17aadef46fd29850160987fe7740ceed1381ad or test export functionality with known formula-triggering input to verify cells are neutralized; periodically retest after any LDAP data changes.

Typical attack path

1. Obtain LDAP write privileges or compromise an account that can modify directory entries
2. Insert spreadsheet formula payloads into LDAP attributes
3. Trigger or wait for an export operation through phpLDAPadmin CSV export feature
4. Deliver the resulting CSV file to a target user who opens it in spreadsheet software
5. Execute commands or exfiltrate data via the triggered formulas

How to detect it

Review exported CSV files for cells beginning with formula characters (=, +, -, @, |); inspect phpLDAPadmin logs or web server access logs for repeated or unusual export requests; correlate with LDAP modification events preceding exports.

What your security team should do

• Immediately review all LDAP data sources feeding phpLDAPadmin exports for untrusted input
• Apply the referenced commit or add pre-export sanitization controls
• Educate administrators on risks of opening exported CSV files in spreadsheet applications
• Monitor EPSS trend and any new exploit maturity signals for increased urgency