CVE-2025-66834
📋 TL;DR
A CSV formula injection vulnerability in TrueConf Server v5.5.2.10813 allows authenticated users to embed malicious spreadsheet formulas in exported chat logs by manipulating their display name. When administrators export chat logs to CSV format and open them in spreadsheet applications like Excel, the formulas execute, potentially leading to data theft or system compromise. This affects organizations using TrueConf Server for video conferencing and chat.
💻 Affected Systems
- TrueConf Server
📦 What is this software?
Server by Trueconf
⚠️ Risk & Real-World Impact
Worst Case
An attacker could execute arbitrary commands on an administrator's computer when they open the malicious CSV file, leading to full system compromise, data exfiltration, or ransomware deployment.
Likely Case
Attackers could steal administrator credentials, session cookies, or sensitive data from the administrator's system through formula execution in Excel/Google Sheets.
If Mitigated
With proper security awareness training and CSV sanitization, the impact is limited to potential data corruption in exported logs.
🎯 Exploit Status
Exploitation requires authenticated user access and administrator interaction with exported files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Monitor TrueConf security advisories for updates.
🔧 Temporary Workarounds
CSV Sanitization Script
linuxAdd a script to sanitize CSV exports by prefixing formula cells with apostrophe or removing special characters
sed -i "s/^[=+\-@]/'&/g" exported_file.csv
Excel Safe Mode
windowsConfigure Excel to open CSV files in protected view or disable automatic formula execution
🧯 If You Can't Patch
- Restrict user permissions to prevent display name changes containing special characters
- Train administrators to never open exported CSV files directly in spreadsheet applications without validation
🔍 How to Verify
Check if Vulnerable:
Test by setting display name to '=HYPERLINK("http://malicious.com","Click")' and exporting chat logs to CSVCheck Version:
trueconf-server --versionVerify Fix Applied:
Verify exported CSV files have formula cells prefixed with apostrophe or special characters removed📡 Detection & Monitoring
Log Indicators:
- User profile updates with display names containing =, +, -, @, or TAB characters
- CSV export operations with unusual file sizes
Network Indicators:
- Outbound connections from administrator workstations after CSV file opens
SIEM Query:
source="trueconf" AND (event="user_update" AND display_name MATCHES "[=+\-@\t]") OR event="export_csv"