CVE-2021-46363 Arbitrary code execution in Magnolia CMS

High 7.8 Published 11 Feb 2022 Updated 4 Aug 2024

Attackers can inject malicious formulas into exported CSV/XLS files, leading to arbitrary code execution when victims open them in Microsoft Excel.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-46363?

CVE-2021-46363 is a high-severity code injection vulnerability in n/a, published on 11 Feb 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files. These formulas may result in arbitrary code execution on a victim's computer when opening the exported files with Microsoft Excel.

Weakness: CWE-1236

Which versions are affected by CVE-2021-46363?

2 open source packages ship an affected version, including info.magnolia:magnolia-core. It affects 1 product.

Package	Affected	Fixed in
`info.magnolia:magnolia-core` Maven	All versions	`6.2.4`
`info.magnolia:magnolia-core` Maven	All versions	`6.2.4`

Products include Magnolia-Cms Magnolia Cms.

How do I fix CVE-2021-46363?

Upgrade info.magnolia:magnolia-core to 6.2.4 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-46363 being exploited?

There is no known exploitation of CVE-2021-46363 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-65hp-4vxr-c356.