CVE-2021-46363
📋 TL;DR
This vulnerability in Magnolia CMS allows attackers to inject malicious formulas into exported CSV/XLS files through the Export function. When victims open these files in Microsoft Excel, the formulas can execute arbitrary code on their computers. It affects Magnolia CMS v6.2.3 and earlier versions.
💻 Affected Systems
- Magnolia CMS
📦 What is this software?
Magnolia Cms by Magnolia Cms
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution on victim computers when malicious exported files are opened in Microsoft Excel, potentially leading to full system compromise.
Likely Case
Data theft, malware installation, or system manipulation through formula injection when users open exported files.
If Mitigated
Limited impact if users don't open exported files in Excel or if Excel security settings block formula execution.
🎯 Exploit Status
Exploitation requires access to export functionality and user interaction to open malicious files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Magnolia CMS 6.2.4
Vendor Advisory: https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory
Restart Required: Yes
Instructions:
1. Backup your Magnolia instance. 2. Upgrade to Magnolia CMS 6.2.4 or later. 3. Restart the application server. 4. Verify the export function no longer allows formula injection.
🔧 Temporary Workarounds
Disable Export Function
allTemporarily disable the export functionality in Magnolia CMS to prevent formula injection attacks.
Configure Magnolia to restrict or disable export features in the admin interface
Excel Security Configuration
windowsConfigure Microsoft Excel to disable automatic formula execution or run in protected view for downloaded files.
Set Excel security to disable automatic formula execution in Trust Center settings
🧯 If You Can't Patch
- Restrict access to export functionality to trusted users only
- Educate users to never open exported CSV/XLS files in Microsoft Excel; use text editors or other spreadsheet software instead
🔍 How to Verify
Check if Vulnerable:
Check Magnolia CMS version; if running v6.2.3 or earlier, the system is vulnerable.Check Version:
Check Magnolia admin interface or application logs for version informationVerify Fix Applied:
After upgrading to v6.2.4 or later, test the export function to ensure formulas cannot be injected into CSV/XLS files.📡 Detection & Monitoring
Log Indicators:
- Unusual export activity patterns
- Multiple export requests from single users
- Large export file generation
Network Indicators:
- Unexpected export file downloads
- CSV/XLS files with formula syntax in content
SIEM Query:
source="magnolia" AND (event="export" OR file_type="csv" OR file_type="xls") AND user_agent!="trusted"🔗 References
- https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46363-Formula%20Injection-Magnolia%20CMS
- https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46363-Formula%20Injection-Magnolia%20CMS
