Hustle stores whatever a visitor types into an opt-in form and writes it unmodified into the email-list CSV export, so an unauthenticated visitor can plant a value that runs as a spreadsheet formula when an administrator opens the export in Excel or a similar program, which can leak data or run commands on the admin’s computer. The 6.0.8.1 fix escaped only a leading =, +, – or @ and could be bypassed with an embedded comma or line break; this patch also writes each row with proper CSV quoting, as Hustle 7.0 does. Affects Hustle 5.0.0 through 6.0.9.
This vulnerability affects the following application versions:
- Hustle 5.0.0
- Hustle 5.0.1
- Hustle 5.0.1.1
- Hustle 5.0.1.2
- Hustle 5.1
- Hustle 5.1.1
- Hustle 5.1.2
- Hustle 5.1.3
- Hustle 5.1.3.1
- Hustle 5.1.3.2
- Hustle 5.1.4
- Hustle 5.1.5
- Hustle 6.0
- Hustle 6.0.1
- Hustle 6.0.2
- Hustle 6.0.3
- Hustle 6.0.4.2
- Hustle 6.0.5
- Hustle 6.0.6.1
- Hustle 6.0.7
- Hustle 6.0.8.1
- Hustle 6.0.9