CVE-2020-29023 CSV Formula Injection possible due to improper fields escaping in GateManager
An authenticated administrator can inject malicious formulas into CSV reports, leading to arbitrary code execution on victims opening the file in spreadsheet software.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-29023?
CVE-2020-29023 is a low-severity code injection vulnerability in Secomea GateManager, published on 16 Feb 2021. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Improper Encoding or Escaping of Output from CSV Report Generator of Secomea GateManager allows an authenticated administrator to generate a CSV file that may run arbitrary commands on a victim's computer when opened in a spreadsheet program (like Excel). This issue affects: Secomea GateManager all versions prior to 9.3.
Weakness: CWE-116
Which versions are affected by CVE-2020-29023?
It affects 4 products.
Products include Secomea Gatemanager 4250 Firmware, Secomea Gatemanager 4260 Firmware, Secomea Gatemanager 8250 Firmware, Secomea Gatemanager 9250 Firmware.
How do I fix CVE-2020-29023?
No fix has been published for CVE-2020-29023 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-29023 being exploited?
There is no known exploitation of CVE-2020-29023 in the wild and no public exploit code.
Other vulnerabilities in Secomea GateManager
- CVE-2020-29026 Path traversal in GateManager
- CVE-2022-25787 GTA URLs issued by LMM WEB API may leak information
- CVE-2020-29031 Insecure Direct Object Reference in GateManager WebUI can cause privilege escalation
- CVE-2021-32010 Clients may connect to a GateManager with TLS 1.0
- CVE-2022-25782 Insufficient privilege checks on object access and updates.
Sources
Also known as GHSA-fw85-97w2-fp5v.