CVE-2021-41824
📋 TL;DR
CVE-2021-41824 is a CSV injection vulnerability in Craft CMS that allows attackers to inject malicious formulas into exported CSV files. When victims open these files in spreadsheet applications like Excel, the formulas can execute arbitrary commands or exfiltrate data. This affects all Craft CMS installations before version 3.7.14.
💻 Affected Systems
- Craft CMS
📦 What is this software?
Craft Cms by Craftcms
⚠️ Risk & Real-World Impact
Worst Case
Attackers can execute arbitrary commands on victims' systems when they open malicious CSV files, potentially leading to full system compromise, data theft, or ransomware deployment.
Likely Case
Attackers trick users into opening CSV files containing malicious formulas that exfiltrate data, execute limited commands, or manipulate spreadsheet data.
If Mitigated
With proper user education and security controls, impact is limited to potential data manipulation within spreadsheets without system compromise.
🎯 Exploit Status
Exploitation requires user interaction (opening CSV file) but the injection technique is simple and well-documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.7.14
Vendor Advisory: https://github.com/craftcms/cms/security/advisories/GHSA-h7vq-5qgw-jwwq
Restart Required: No
Instructions:
1. Backup your Craft CMS installation. 2. Update Craft CMS to version 3.7.14 or later via Composer: 'composer require craftcms/cms:^3.7.14'. 3. Clear caches if necessary.
🔧 Temporary Workarounds
Disable CSV Export
allTemporarily disable CSV export functionality in Craft CMS until patching is possible.
Input Sanitization
allImplement custom validation to sanitize user input that may be included in CSV exports.
🧯 If You Can't Patch
- Educate users to never open CSV files from untrusted sources in spreadsheet applications
- Configure spreadsheet applications to disable automatic formula execution
🔍 How to Verify
Check if Vulnerable:
Check Craft CMS version in admin panel or via 'composer show craftcms/cms' command.Check Version:
composer show craftcms/cms | grep versionVerify Fix Applied:
Verify version is 3.7.14 or later and test CSV export functionality with formula characters.📡 Detection & Monitoring
Log Indicators:
- Unusual CSV export requests
- Requests containing formula characters (=, +, -, @) in export parameters
Network Indicators:
- Large CSV file downloads from Craft CMS
- Outbound connections from spreadsheet applications after CSV opens
SIEM Query:
source="craftcms" AND (url="*export*" OR url="*csv*") AND (params="*=*" OR params="*+*" OR params="*-*" OR params="*@*")🔗 References
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3714---2021-09-28
- https://github.com/craftcms/cms/security/advisories/GHSA-h7vq-5qgw-jwwq
- https://twitter.com/craftcmsupdates/status/1442928690145366018
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3714---2021-09-28
- https://github.com/craftcms/cms/security/advisories/GHSA-h7vq-5qgw-jwwq
- https://twitter.com/craftcmsupdates/status/1442928690145366018
