We have found an additional attack path not covered by issue APPSEC-978, which was resolved in patch https://magento.com/security/patches/supee-5994 for Magento 1.x.A user could provide input that executes a formula when exported and opened in a spreadsheet such as Microsoft Excel. This formula could modify data, export personal data to another site, or cause remote code execution. The spreadsheet typically displayed a warning message, which the user must dismiss, for the attack to succeed.
Note: The code that protects against this attack modifies the exported file by prepending some fields with a space. As a result, this fix can lead to data inconsistency. (Data inconsistency might occur when fields, such as product name or description, start from =, + or – sign.)
If this fix causes problems with your data processing, you can disable it. Be aware, however, that this protection is enabled by default. Disabling can lead to an increased security risk.
To disable this fix, log in to the Admin Panel, then use the System tab to navigate to the Export CSV fields.
Part of patch SUPEE-7405
This vulnerability affects the following application versions:
- Magento 1.6.0.0
- Magento 1.6.1.0
- Magento 1.6.2.0
- Magento 1.7.0.0
- Magento 1.7.0.1
- Magento 1.7.0.2
- Magento 1.8.0.0
- Magento 1.8.1.0
- Magento 1.9.0.0
- Magento 1.9.0.1
- Magento 1.9.1.0
- Magento 1.9.1.1
- Magento 1.9.2.0
- Magento 1.9.2.1
- Magento 1.9.2.2