exploit the possibilities

osTicket 1.12 Formula Injection

osTicket 1.12 Formula Injection
Posted Aug 11, 2019
Authored by Aishwarya Iyer

An issue was discovered in osTicket versions before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the export spreadsheets functionality. These spreadsheets are generated dynamically from unvalidated or unfiltered user input in the Name and Internal Notes fields in the Users tab, and the Issue Summary field in the tickets tab. This allows other agents to download data in a .csv file format or .xls file format. This is used as input for spreadsheet applications such as Excel and OpenOffice Calc, resulting in a situation where cells in the spreadsheets can contain input from an untrusted source. As a result, the end user who is accessing the exported spreadsheet can be affected.

tags | exploit
advisories | CVE-2019-14749
MD5 | cc76b35884570d42ac82d96a2c35e7fa

osTicket 1.12 Formula Injection

Change Mirror Download
# Exploit Title: osTicket-v1.12 Formula Injection
# Vendor Homepage: https://osticket.com/
# Software Link: https://osticket.com/download/
# Exploit Author: Aishwarya Iyer
# Contact: https://twitter.com/aish_9524
# Website: https://about.me/aish_iyer
# Category: webapps
# CVE: CVE-2019-14749

1. Description


An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.
CSV (aka Formula) injection exists in the export spreadsheets
functionality. These spreadsheets are generated dynamically from
unvalidated or unfiltered user input in the Name and Internal Notes fields
in the Users tab, and the Issue Summary field in the tickets tab. This
allows other agents to download data in a .csv file format or .xls file
format. This is used as input for spreadsheet applications such as Excel
and OpenOffice Calc, resulting in a situation where cells in the
spreadsheets can contain input from an untrusted source. As a result, the end
user who is accessing the exported spreadsheet can be affected.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14749

2. Proof of Concept

Steps to Reproduce:
- Login as an agent and under the "Users" section create a new user.
- Insert the crafted payload of Formula Injection into "Name" and "Internal
Notes" field.
- Login as another agent and under the Users tab, click on export and then
save the ".csv" file.
- It is observed that the payload gets executed in excel and this leads to
remote code execution.
- Not just an agent, even a non-agent user has the option to edit his name
where he can insert the malicious payload of Formula Injection.
- The application does not sanitize the inputs here due to which when the
agent clicks on export the payload gets executed.
-The same issue persisted in the "Issue Summary" field in the tickets tab.

3. Reference

https://github.com/osTicket/osTicket/commit/99818486c5b1d8aa445cee232825418d6834f249
https://github.com/osTicket/osTicket/releases/tag/v1.12.1
https://github.com/osTicket/osTicket/releases/tag/v1.10.7

4. Solution

The vulnerability has been patched by the vendor in the next release which
is osTicket v1.10.7.

--
Best Regards,
Aishwarya Iyer
https://about.me/aish_iyer

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

October 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    24 Files
  • 2
    Oct 2nd
    15 Files
  • 3
    Oct 3rd
    7 Files
  • 4
    Oct 4th
    4 Files
  • 5
    Oct 5th
    10 Files
  • 6
    Oct 6th
    1 Files
  • 7
    Oct 7th
    21 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    5 Files
  • 10
    Oct 10th
    20 Files
  • 11
    Oct 11th
    17 Files
  • 12
    Oct 12th
    4 Files
  • 13
    Oct 13th
    4 Files
  • 14
    Oct 14th
    15 Files
  • 15
    Oct 15th
    19 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close