CVE-2018-11652
📋 TL;DR
CVE-2018-11652 is a CSV injection vulnerability in Nikto web scanner that allows remote attackers to execute arbitrary OS commands when Nikto processes malicious HTTP response headers. Attackers can inject commands via the Server field in HTTP responses, which get directly written to CSV reports and executed when opened in spreadsheet applications. This affects Nikto users who scan untrusted websites and open generated CSV reports.
💻 Affected Systems
- Nikto
📦 What is this software?
Nikto by Cirt.net
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary command execution when malicious CSV report is opened, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local command execution on the analyst's machine when opening CSV reports generated from scanning malicious websites, leading to malware infection or credential theft.
If Mitigated
No impact if CSV reports are not opened in vulnerable spreadsheet applications or if input sanitization is applied.
🎯 Exploit Status
Exploit requires Nikto to scan a malicious website that returns crafted HTTP headers, then user must open the generated CSV file in a vulnerable spreadsheet application like Excel or LibreOffice.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.7 and later
Vendor Advisory: https://github.com/sullo/nikto/commit/e759b3300aace5314fe3d30800c8bd83c81c29f7
Restart Required: No
Instructions:
1. Update Nikto to version 2.1.7 or later. 2. For manual patch: Apply the commit e759b3300aace5314fe3d30800c8bd83c81c29f7 which adds CSV output sanitization. 3. No service restart needed as Nikto is a command-line tool.
🔧 Temporary Workarounds
Use alternative output formats
allAvoid CSV output format entirely by using XML, JSON, or HTML report formats instead.
nikto -h target.com -Format xml
nikto -h target.com -Format json
nikto -h target.com -Format htm
Sanitize CSV output manually
linuxProcess CSV files through a sanitizer before opening to remove potentially malicious content.
sed -i 's/^=//g; s/^+//g; s/^-//g; s/^@//g' nikto_report.csv
🧯 If You Can't Patch
- Never open CSV reports from Nikto scans in spreadsheet applications; use text editors or parse programmatically.
- Scan only trusted websites or isolate Nikto scanning to dedicated, disposable virtual machines.
🔍 How to Verify
Check if Vulnerable:
Check Nikto version: if version is 2.1.6 or earlier, it's vulnerable. Test by scanning a test server with malicious Server header and checking if CSV output contains unsanitized formulas.Check Version:
nikto -VersionVerify Fix Applied:
After updating to 2.1.7+, verify CSV output properly escapes formula characters (=, +, -, @) by checking that they appear as plain text, not executable formulas.📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from spreadsheet applications opening CSV files
- CSV files with formula characters in Server field data
Network Indicators:
- Nikto scanning activity followed by unexpected outbound connections from analyst workstations
SIEM Query:
process_name: (excel.exe, soffice.bin, calc.exe) AND cmdline: *.csv AND parent_process: nikto.pl