CVE-2018-1547

Vulnerability

IBM Robotic Process Automation with Automation Anywhere version 10.0.0.0 is affected by a remote code execution vulnerability [1]. The issue stems from improper output encoding when generating CSV exports. An attacker can embed malicious formulas or commands within the CSV data, which are not properly sanitized before being written to the file. When the victim opens the crafted CSV export in Microsoft Excel, the formulas may be executed automatically or after user confirmation, depending on Excel's security settings [1].

Exploitation

To exploit this vulnerability, an attacker must first persuade a victim to download a specially crafted CSV export file generated by the affected IBM Robotic Process Automation software (with Automation Anywhere 10.0) [1]. The attacker does not require any special network access beyond being able to serve or link the malicious CSV to the victim. The victim must then open the CSV file in Microsoft Excel. Upon opening, Excel may display two security prompts (e.g., regarding external content or data connections). If the victim confirms these prompts, the embedded malicious command or program will execute on the victim's machine [1]. User interaction is therefore required, and the exploitation is not fully automatic.

Impact

Successful exploitation allows the attacker to execute arbitrary commands or programs on the victim's machine with the privileges of the current user. Since the attacker controls the embedded formulas, this can lead to full compromise of the system, including data exfiltration (confidentiality breach), modification or destruction of data (integrity loss), and potential further lateral movement (availability impact). The CVSS v3.0 score is 8.0 (High) with vector AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H [1], indicating high confidentiality, integrity, and availability impacts, though requiring user interaction and high attack complexity.

Mitigation

IBM released a security bulletin (swg22016197) addressing this vulnerability [1]. As of the publication date (2018-06-07), no specific workaround is available; IBM recommends upgrading to a fixed version. Users of IBM Robotic Process Automation with Automation Anywhere V10.0.0.0 should apply the patch or update as per the vendor's instructions. Additionally, administrators can advise users to exercise caution when opening CSV exports from the affected software, particularly if the file originates from untrusted sources, until the patch is applied. No other mitigations are detailed in the available references [1].