PT-2022-12671 · Microsoft · Office Excel

Published 2022-02-11 · Updated 2022-06-05 · CVE-2021-46363

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Magnolia versions 6.2.3 and below

Description An issue in the Export function of Magnolia allows attackers to perform Formula Injection attacks via crafted CSV/XLS files, potentially resulting in arbitrary code execution on a victim's computer when opening the exported files with Microsoft Excel. Attackers can execute arbitrary code via a crafted CSV/XLS file.

Recommendations For Magnolia versions 6.2.3 and below, consider disabling the Export function until a patch is available to prevent arbitrary code execution via crafted CSV/XLS files. Restrict access to the Export function to minimize the risk of exploitation. Avoid using the Export function with Microsoft Excel until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2021-46363

GHSA-65HP-4VXR-C356

Affected Products

Office Excel

References · 8

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46363-Formula%20Injection-Magnolia%20CMS · Exploit
• https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46363 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46363 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-65hp-4vxr-c356 · Vendor Advisory
• https://t.me/cvenotify/26705 · Telegram Post
• https://t.me/cibsecurity/37360 · Telegram Post
• https://t.me/cvenotify/26907 · Telegram Post