CVE-2020-13247

Vulnerability

BooleBox Secure File Sharing Utility versions before 4.2.3.0 are vulnerable to CSV injection (Excel Macro Injection) in the export feature of the Audit Area. The user's name parameter is insufficiently sanitized when constructing CSV files containing activity logs, allowing injection of arbitrary formulas. Affected versions: all prior to 4.2.3.0 [1][2].

Exploitation

An attacker with a valid user account can modify their own name in the "My Account – Personal Data" section to include a malicious formula starting with '=', for example =cmd|' /C calc'!A1 Smith. After performing an action that is recorded in the activity logs (e.g., renaming a file), the attacker waits for a privileged administrator to export the logs as CSV from the Audit Area. When the administrator opens the CSV file with Microsoft Excel, the formula is executed, potentially running arbitrary commands on the administrator's machine [1][2].

Impact

Successful exploitation allows arbitrary formula execution in the context of the administrator's Excel session. This can lead to system compromise, data exfiltration, or further malware installation, depending on the injected macro. The attacker gains the ability to execute arbitrary commands on the administrator's machine when the CSV is opened [1].

Mitigation

The fix was released in version 4.2.3.0. The vendor implemented two controls: (1) a regular expression on personal data fields that only allows alphabetic characters, preventing injection of formulas; (2) during audit export, any existing dangerous strings are replaced with "Invalid name". Users should upgrade to version 4.2.3.0 or later. No workaround is mentioned; the vulnerability is not listed on CISA KEV [2].