PT-2023-31887 · Unknown · Activeadmin

Mgrunberg · Published 2023-12-23 · Updated 2024-01-03 · CVE-2023-51763

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ActiveAdmin versions prior to 3.2.0

Description The issue allows CSV injection, which can lead to remote code execution and private data exfiltration when maliciously crafted spreadsheet formulas are uploaded and imported into a spreadsheet program. The attacker needs privileges to upload data and the victim must ignore security warnings from their spreadsheet program.

Recommendations For versions prior to 3.2.0, update to version 3.2.0 or above, which fixes the problem by escaping any data starting with = and other characters used by spreadsheet programs. As a temporary workaround, consider only turning on formula evaluation in spreadsheet programs when importing CSV after explicitly reviewing the file.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2023-51763

GHSA-RQXC-9P8H-XQGQ

GHSA-XHVV-3JWW-C487

Affected Products

Activeadmin

References · 19

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activeadmin/CVE-2023-51763.yml · Exploit
• https://github.com/activeadmin/activeadmin/commit/697be2b183491beadc8f0b7d8b5bfb44f2387909 · Patch
• https://github.com/activeadmin/activeadmin/pull/8161 · Patch
• https://osv.dev/vulnerability/CVE-2023-51763 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-51763 · Security Note
• https://osv.dev/vulnerability/GHSA-xhvv-3jww-c487 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rqxc-9p8h-xqgq · Vendor Advisory
• https://github.com/activeadmin/activeadmin/releases/tag/v3.2.0 · Note
• https://github.com/activeadmin/activeadmin · Note
• https://github.com/activeadmin/activeadmin/security/advisories/GHSA-xhvv-3jww-c487 · Note
• https://github.com/activeadmin/activeadmin/commit/7af735cf657c73734fca1900cd6a5adac4ee706e · Note
• https://github.com/activeadmin/activeadmin/pull/8167 · Note
• https://jzee-rx.medium.com/cve-2023-51763-csv-injection-in-activeadmin-a-security-research-breakdown-d5b0d3663aa4 · Note
• https://t.me/cvenotify/65051 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1738811137787912246 · Twitter Post