New issue
Advanced search Search tips

Issue 672064 link

Starred by 2 users
Status: WontFix
Owner: ----
Closed: Dec 2016
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug-Security



Sign in to add a comment

Command injection on client via monorail CSV export

Reported by anasro...@gmail.com, Dec 7 2016 
UserAgent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0

Steps to reproduce the problem:
1. Go to https://chromiumbugs.appspot.com
2. Open a new issue under the name =cmd|' /c calc'!a0
3. Export the last issues as CSV
4. Open the file you have downloaded and the calculator will open 

What is the expected behavior?
This can be used to run commands on the victims device

What went wrong?
the = character isn't filtered  

Did this work before? N/A 

Chrome version: <Copy from: 'about:version'>  Channel: n/a
OS Version: 10.0
Flash Version: 

The same bugs are here if you want to have a look

https://hackerone.com/reports/72785
https://hackerone.com/reports/126109
/chromium-issues.csv
90.5 KB View Download

Comment 1 by elawrence@chromium.org, Dec 7 2016

Summary: Command injection on client via monorail CSV export (was: CSV injection vulnerability)
This originally came in as 656277, which was rather less interesting.

The claim now is that some CSV viewers are so absurdly broken that they'll run code based on the contents of the CSV file.

It seems pretty obvious that this is a bug in the CSV viewer, not in the exporter.

If the Monorail team wanted to provide a DiD for this, we probably need to move this bug over at https://bugs.chromium.org/p/monorail/issues/list

Comment 2 by anasro...@gmail.com, Dec 7 2016 

No this bug is on the exporter,

please read more about CSV injection vulnerabilities amd see these bugs.

https://hackerone.com/reports/72785
https://hackerone.com/reports/126109

Comment 3 by elawrence@chromium.org, Dec 7 2016 

It's a stretch to call it a bug in the exporter, insofar as the exporter doesn't do anything unreasonable.

I've confirmed that a really really naive Excel user can suffer code execution via this scenario. Screenshot attached.
ExploitInExcel2016.png
36.6 KB View Download

Comment 4 by anasro...@gmail.com, Dec 7 2016 

I really know that this type of vulnerabilitoes are not famous like XSS and SQL injection etc..

So please if you want to read more abote this you can read here

https://www.contextis.com//resources/blog/comma-separated-vulnerabilities/

and thanks very much :)

Comment 5 by elawrence@chromium.org, Dec 7 2016

Status: Untriaged (was: Unconfirmed)

Comment 6 by elawrence@chromium.org, Dec 7 2016 

If we decided to fix this, we could probably make a simple modification to \infra\appengine\monorail\tracker\tablecell.py's function

class TableCellSummaryCSV(table_view_helpers.TableCell):
  """TableCell subclass for showing issue summaries escaped for CSV."""

Comment 7 by anasro...@gmail.com, Dec 8 2016 

Yes,
Will you fix it then?

Comment 8 by elawrence@chromium.org, Dec 8 2016

Status: WontFix (was: Untriaged)
Moved to https://bugs.chromium.org/p/monorail/issues/detail?id=1996

Comment 9 by anasro...@gmail.com, Dec 8 2016 

Just asking if there will be any kind of reword when it's fixed? :)
Project Member

Comment 10 by sheriffbot@chromium.org, Mar 17 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment