Issue:                  CSV injection vulnerability

CVE:                    CVE-2019-13181

Security researcher:    Richard Tan @ The Missing Link Security

Product name:           Serv-U FTP Server

Product version:        Tested on 15.1.7

Fixed in:               Serv-U 15.1.7 Hotfix 2

 

 

# Overview

The application allowed table entries to contain a string which could  be
evaluated by Excel as a Dynamic Data Exchange (DDE) macro.

Privileged users who has the appropriate rights to modify or create users
could insert values into user properties which is evaluated as macros if the
user list is exported as an Excel format.

 

Steps to reproduce (Proof of concept):

1)      Login as a user that has privileges to create or modify users.

2)      Create a new user and add the following payload into the
"description" field.  "=cmd|'/C calc.exe'!A0"

3)      Export the user list with a file name "CSVinjection.csv" on the
application server.

4)      On the application server, locate the file and execute it. Notice
that a warning sign could be prompted depending the Excel's security
settings. (If so click enable)

5)      Observe that the calculator tool is executed. This is a proof of
concept however an adversary could exploit this weakness to potentially gain
access to the application server (or from where ever the file is executed
from).