CVE-2023-2629: Improper Neutralization of Formula Elements in a CSV File in pimcore/customer-data-framework
Impact The pimcore application is vulnerable to Formula Injection/CSV Injection via the Firstname, Lastname, Street, Zip & City input fields. These vulnerabilities allow unauthenticated attackers to execute arbitrary code via a crafted excel file.
Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.
Patches Update to version 3.3.9 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/4e0105c3a78d20686a0c010faef27d2297b98803.patch
Workarounds Apply patch https://github.com/pimcore/customer-data-framework/commit/4e0105c3a78d20686a0c010faef27d2297b98803.patch manually.
References https://huntr.dev/bounties/821ff465-4754-42d1-9376-813c17f16a01/
Other sources
Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-2629?
CVE-2023-2629 refers to the vulnerability of Improper Neutralization of Formula Elements in a CSV File in the GitHub repository pimcore/customer-data-framework prior to version 3.3.9.
What is the severity of CVE-2023-2629?
CVE-2023-2629 has a severity rating of 7.8 (high).
Which software versions are affected by CVE-2023-2629?
The Pimcore Customer Management Framework versions up to exclusive version 3.3.9 are affected by CVE-2023-2629.
How can I fix CVE-2023-2629?
To fix CVE-2023-2629, it is recommended to update the Pimcore Customer Management Framework to version 3.3.9 or higher.
Where can I find more information about CVE-2023-2629?
You can find more information about CVE-2023-2629 in the GitHub repository at https://github.com/pimcore/customer-data-framework/commit/4e0105c3a78d20686a0c010faef27d2297b98803 and on Huntr.dev at https://huntr.dev/bounties/821ff465-4754-42d1-9376-813c17f16a01.