GHSA-whrx-mmgr-gpcf: Composer/snipe/snipe-it vulnerability
Impact In Snipe-IT v8.6.1 and lower, Actionlog::logaction() stores the request User-Agent header in useragent. That value is later included in the Activity Report CSV export by ReportsController::postActivityReport() and written with plain fputcsv().
A low-privileged authenticated user can set a formula-like User-Agent, perform a logged action, and have that value stored in the activity log. If an admin or report viewer later exports the Activity Report and opens it in spreadsheet software, the formula may execute.
Example payload:
User-Agent: =HYPERLINK("https://example.com/","click")
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.2
Event History
Frequently Asked Questions
Which deployments are affected?
Snipe-IT version 8.6.1 and lower are affected.
What level of access does an attacker need?
An attacker needs a low-privileged authenticated account. They must be able to perform an action that is recorded in the activity log while supplying a formula-like User-Agent header.
When does the payload become dangerous?
The stored value is triggered when an administrator or report viewer exports the Activity Report as CSV and opens that export in spreadsheet software that evaluates the formula.