CVE-2021-41128
📋 TL;DR
CVE-2021-41128 is a CSV injection vulnerability in Hygeia that allows users to embed malicious formulas in exported CSV files. When these files are opened in spreadsheet applications like Excel, the formulas execute, potentially leading to command execution or data theft. All Hygeia users running versions before 1.30.4 are affected.
💻 Affected Systems
- Hygeia
📦 What is this software?
Hygeia by Hygeia Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution on victim's machine when malicious CSV is opened in Excel, leading to full system compromise, data exfiltration, or ransomware deployment.
Likely Case
Local command execution on the victim's computer when CSV is opened, potentially stealing credentials, installing malware, or accessing sensitive files.
If Mitigated
Formula execution blocked by spreadsheet security settings or user awareness, resulting in no impact beyond formula display errors.
🎯 Exploit Status
Exploit requires authenticated user access to create malicious CSV exports. CSV injection techniques are well-documented and easy to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.30.4
Vendor Advisory: https://github.com/jshmrtn/hygeia/security/advisories/GHSA-8pwv-jhj2-2369
Restart Required: Yes
Instructions:
1. Backup your Hygeia installation and database. 2. Stop the Hygeia service. 3. Update to version 1.30.4 via package manager or manual installation. 4. Restart the Hygeia service. 5. Verify the update was successful.
🔧 Temporary Workarounds
Disable CSV exports
allTemporarily disable CSV export functionality in Hygeia configuration
Modify Hygeia configuration to remove CSV export options
User education and controls
allTrain users to open CSV files in text editors only, not spreadsheet applications
🧯 If You Can't Patch
- Implement strict user access controls to limit who can create CSV exports
- Deploy endpoint protection that blocks execution of formulas from CSV files
🔍 How to Verify
Check if Vulnerable:
Check Hygeia version: if version < 1.30.4, system is vulnerable. Test CSV export functionality for formula injection.Check Version:
Check Hygeia web interface or configuration files for version numberVerify Fix Applied:
After updating to 1.30.4, test CSV exports with formula payloads - they should be sanitized or escaped.📡 Detection & Monitoring
Log Indicators:
- Unusual CSV export patterns
- Multiple large CSV exports from single user
- CSV exports containing formula-like strings
Network Indicators:
- CSV file downloads containing =, +, -, @ characters at start of fields
SIEM Query:
source="hygeia" AND (event="csv_export" OR file_type="csv") AND (payload CONTAINS "=" OR payload CONTAINS "+" OR payload CONTAINS "-" OR payload CONTAINS "@")🔗 References
- https://github.com/beatrichartz/csv/issues/103
- https://github.com/beatrichartz/csv/pull/104
- https://github.com/jshmrtn/hygeia/commit/d917f27432fe84e1c9751222ae55bae36a4dce60
- https://github.com/jshmrtn/hygeia/security/advisories/GHSA-8pwv-jhj2-2369
- https://owasp.org/www-community/attacks/CSV_Injection
- https://github.com/beatrichartz/csv/issues/103
- https://github.com/beatrichartz/csv/pull/104
- https://github.com/jshmrtn/hygeia/commit/d917f27432fe84e1c9751222ae55bae36a4dce60
- https://github.com/jshmrtn/hygeia/security/advisories/GHSA-8pwv-jhj2-2369
- https://owasp.org/www-community/attacks/CSV_Injection
