CVE-2020-22390
📋 TL;DR
CVE-2020-22390 is a CSV injection vulnerability in Akaunting accounting software that allows attackers to inject malicious formulas into exported CSV files. When victims open these crafted files in spreadsheet applications like Excel, arbitrary code execution can occur on their systems. This affects all Akaunting users running vulnerable versions who export data containing user-controlled input.
💻 Affected Systems
- Akaunting
📦 What is this software?
Akaunting by Akaunting
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of victim's workstation when malicious CSV file is opened in vulnerable spreadsheet software, potentially leading to malware installation, data theft, or lateral movement.
Likely Case
Victim's spreadsheet application executes malicious formulas, potentially stealing credentials, downloading malware, or accessing local files.
If Mitigated
Limited impact if users open CSV files in text editors instead of spreadsheet software, or if spreadsheet applications have security features enabled.
🎯 Exploit Status
Exploitation requires authenticated access to create/modify items with malicious names, then convincing victim to open exported CSV file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.10
Vendor Advisory: https://github.com/akaunting/akaunting/releases/tag/2.0.10
Restart Required: No
Instructions:
1. Backup your Akaunting installation and database. 2. Download version 2.0.10 or later from official sources. 3. Replace existing files with new version. 4. Clear cache if applicable.
🔧 Temporary Workarounds
Input Sanitization
allAdd server-side validation to sanitize item names by stripping or escaping special characters like =, +, -, @
CSV Export Filtering
allModify export function to prepend apostrophe to formula-containing cells or escape special characters
🧯 If You Can't Patch
- Restrict user permissions to prevent untrusted users from creating/modifying item names
- Educate users to open CSV files in text editors only, not spreadsheet applications
🔍 How to Verify
Check if Vulnerable:
Check Akaunting version in admin panel or via composer show akaunting/akaunting. If version <= 2.0.9, vulnerable.Check Version:
php artisan versionVerify Fix Applied:
After patching, attempt to export items with formula-like names (=cmd|' /C calc'!A0) and verify they are properly escaped in CSV output.📡 Detection & Monitoring
Log Indicators:
- Multiple failed export attempts
- Unusual item name patterns containing special characters
Network Indicators:
- CSV file downloads containing formula patterns
SIEM Query:
source="akaunting.log" AND ("export" OR "csv") AND ("=" OR "+" OR "-" OR "@")