CVE-2022-1544
📋 TL;DR
This CVE describes a CSV injection vulnerability in the yii-helpers library prior to version 1.2.1. Attackers can embed malicious formulas in CSV files that execute when opened in spreadsheet applications like Excel, potentially leading to command execution or data exfiltration. Applications using vulnerable versions of yii-helpers to generate or process CSV files are affected.
💻 Affected Systems
- luyadev/yii-helpers
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution on client machines when users open malicious CSV files in vulnerable spreadsheet applications, leading to full system compromise and data theft.
Likely Case
Formula execution in spreadsheet applications that could leak sensitive data, corrupt files, or execute limited commands depending on the application's security settings.
If Mitigated
No impact if CSV files are processed only by applications that don't interpret formulas or if proper input validation is implemented.
🎯 Exploit Status
Exploitation requires user interaction (opening CSV file) and vulnerable spreadsheet application. The vulnerability is well-documented with public proof-of-concept examples available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.1
Vendor Advisory: https://github.com/luyadev/yii-helpers/commit/9956ed63f516110c2b588471507b870e748c4cfb
Restart Required: No
Instructions:
1. Update yii-helpers dependency to version 1.2.1 or later. 2. Update composer.json to require "luyadev/yii-helpers": "^1.2.1". 3. Run composer update luyadev/yii-helpers. 4. Deploy updated application.
🔧 Temporary Workarounds
Input Sanitization
allManually sanitize CSV output by prefixing formula characters with apostrophe or escaping special characters
// PHP example: $value = "'" . str_replace(["=", "+", "-", "@"], ["'=", "'+", "'-", "'@"], $value);
CSV Content-Type Header
allSet proper Content-Type headers to prevent automatic opening in spreadsheet applications
header('Content-Type: text/csv; charset=utf-8');
header('Content-Disposition: attachment; filename="data.csv"');
🧯 If You Can't Patch
- Implement server-side validation to strip or escape formula characters (=, +, -, @, etc.) from CSV output
- Educate users to never open CSV files from untrusted sources in spreadsheet applications that execute formulas
🔍 How to Verify
Check if Vulnerable:
Check composer.json or composer.lock for "luyadev/yii-helpers" version lower than 1.2.1Check Version:
composer show luyadev/yii-helpers | grep versionsVerify Fix Applied:
Verify installed version is 1.2.1 or higher using composer show luyadev/yii-helpers📡 Detection & Monitoring
Log Indicators:
- Unusual CSV export requests, especially with formula-like payloads in parameters
Network Indicators:
- CSV file downloads containing formula characters at the beginning of cells
SIEM Query:
source="web_logs" AND (uri_path="*.csv" OR content_type="text/csv") AND (query="*=%2B*" OR query="*=@*" OR query="*=-*" OR query="*==*")🔗 References
- https://github.com/luyadev/yii-helpers/commit/9956ed63f516110c2b588471507b870e748c4cfb
- https://huntr.dev/bounties/fa6d6e75-bc7a-40f6-9bdd-2541318912d4
- https://github.com/luyadev/yii-helpers/commit/9956ed63f516110c2b588471507b870e748c4cfb
- https://huntr.dev/bounties/fa6d6e75-bc7a-40f6-9bdd-2541318912d4
