CVE-2018-19855 in Orchestrator
Summary
by MITRE
UiPath Orchestrator before 2018.3.4 allows CSV Injection, related to the Audit export, Robot log export, and Transaction log export features.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/21/2023
The vulnerability identified as CVE-2018-19855 affects UiPath Orchestrator versions prior to 2018.3.4 and represents a significant security flaw that enables CSV injection attacks through multiple export functionalities. This issue specifically impacts the Audit export, Robot log export, and Transaction log export features within the UiPath automation platform, creating potential vectors for malicious code execution and data manipulation. The vulnerability stems from insufficient input validation and sanitization of user-supplied data within the export mechanisms, allowing attackers to craft malicious CSV content that can be executed when the exported files are opened in spreadsheet applications.
The technical flaw manifests when users export audit, robot log, or transaction log data from the UiPath Orchestrator interface, as the system does not properly escape or sanitize special characters that have meaning in CSV format. Attackers can leverage this weakness by including malicious formulas or commands within the exported data fields, which then get interpreted by spreadsheet applications when users open the exported files. This creates a classic CSV injection scenario where the injected content can execute arbitrary code, steal data, or perform unauthorized actions on the victim's system. The vulnerability is particularly concerning because it operates at the intersection of data export functionality and spreadsheet application behavior, exploiting the inherent trust users place in exported files.
The operational impact of this vulnerability extends beyond simple data manipulation, as it can lead to full system compromise when users open maliciously crafted export files. An attacker who gains access to the UiPath Orchestrator environment can craft malicious entries in audit logs, robot logs, or transaction logs that, when exported and opened by unsuspecting users, execute harmful payloads such as macros, shell commands, or network requests. This type of attack can result in data exfiltration, system infiltration, or lateral movement within the network. The vulnerability is particularly dangerous in enterprise environments where UiPath Orchestrator is used for process automation and where users regularly open exported files for analysis and reporting purposes.
Organizations using affected UiPath Orchestrator versions should immediately implement mitigations including upgrading to version 2018.3.4 or later, which contains proper input validation and sanitization measures. Additionally, administrators should consider implementing strict access controls and monitoring for export activities, as well as educating users about the risks of opening untrusted exported files. The vulnerability aligns with CWE-1236, which addresses improper input validation in CSV data, and maps to ATT&CK technique T1059.005 for command and scripting interpreter usage, particularly when malicious formulas are executed within spreadsheet applications. Organizations should also consider implementing network segmentation and monitoring for unusual export activity to detect potential exploitation attempts.