CVE-2024-29375
📋 TL;DR
A CSV injection vulnerability in Addactis IBNRS v.3.10.3.107 allows remote attackers to execute arbitrary code by uploading a malicious .ibnrs file containing crafted payloads in specific parameters. This affects all users running the vulnerable version of the software, potentially leading to complete system compromise.
💻 Affected Systems
- Addactis IBNRS
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution leading to complete system takeover, data exfiltration, ransomware deployment, or lateral movement within the network.
Likely Case
Remote code execution with the privileges of the IBNRS application user, allowing file system access, data manipulation, and potential privilege escalation.
If Mitigated
Limited impact through proper input validation, file upload restrictions, and network segmentation preventing successful exploitation.
🎯 Exploit Status
Exploitation requires file upload capability to the vulnerable application. Public proof-of-concept demonstrates the vulnerability but may require authentication to upload files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
Contact Addactis for official patch information. Monitor vendor communications for security updates.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and sanitization for all parameters accepting .ibnrs file data, particularly Project Description, Identifiers, Custom Triangle Name, and Yield Curve Name fields.
File Upload Restrictions
allRestrict file uploads to trusted sources only, implement file type verification, and scan uploaded files for malicious content.
🧯 If You Can't Patch
- Isolate the IBNRS application in a segmented network zone with strict inbound/outbound firewall rules.
- Implement application-level controls to block or sanitize CSV formula injection patterns in user inputs.
🔍 How to Verify
Check if Vulnerable:
Check if running Addactis IBNRS version 3.10.3.107. Test by attempting to upload a .ibnrs file with CSV injection payloads in vulnerable parameters.Check Version:
Check application version through the IBNRS interface or installation directory properties.Verify Fix Applied:
Verify updated version from vendor and test that CSV injection payloads are properly sanitized or rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to IBNRS application
- CSV formula patterns in input parameters
- Unexpected process execution from IBNRS
Network Indicators:
- Unusual outbound connections from IBNRS server
- File uploads containing formula injection patterns
SIEM Query:
Search for file upload events to IBNRS containing characters like =, +, -, @ followed by command patterns, or unexpected process creation from IBNRS executable.