osTicket up to 1.10.6/1.12.0 Formula Spreadsheet injection

Summaryinfo

A vulnerability has been found in osTicket up to 1.10.6/1.12.0 and classified as critical. This affects an unknown function of the component Formula Handler. Performing a manipulation as part of Spreadsheet results in injection. This vulnerability was named CVE-2019-14749. The attack may be initiated remotely. In addition, an exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in osTicket up to 1.10.6/1.12.0 (Ticket Tracking Software). This affects an unknown part of the component Formula Handler. The manipulation as part of a Spreadsheet leads to a injection vulnerability. CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the export spreadsheets functionality. These spreadsheets are generated dynamically from unvalidated or unfiltered user input in the Name and Internal Notes fields in the Users tab, and the Issue Summary field in the tickets tab. This allows other agents to download data in a .csv file format or .xls file format. This is used as input for spreadsheet applications such as Excel and OpenOffice Calc, resulting in a situation where cells in the spreadsheets can contain input from an untrusted source. As a result, the end user who is accessing the exported spreadsheet can be affected.

The weakness was presented 08/07/2019 (Website). The advisory is shared at exploit-db.com. This vulnerability is uniquely identified as CVE-2019-14749 since 08/07/2019. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1055 for this issue.

It is declared as proof-of-concept.

Upgrading to version 1.10.7 or 1.12.1 eliminates this vulnerability.

See VDB-139654 and VDB-139652 for similar entries. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Ticket Tracking Software

Name

• osTicket

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.10.0
• 1.10.1
• 1.10.2
• 1.10.3
• 1.10.4
• 1.10.5
• 1.10.6
• 1.11
• 1.12.0

License

• open-source

Website

• Product: https://github.com/osTicket/osTicket/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion