Executive brief
KeystoneJS is a Node.js web application framework that includes admin interfaces and data management features. An attacker can inject malicious formulas into CSV export files that, when opened in spreadsheet applications like Excel, execute arbitrary code on a user's computer—a technique known as CSV injection or formula injection.
Technical details
CSV Injection (CWE-20: Improper Input Validation) exists in the CSV export functionality of KeystoneJS versions prior to 4.0.0-beta.7, specifically in admin/server/api/download.js and lib/list/getCSVData.js. When a user exports data to CSV format, untrusted values in database fields are not sanitized before being written to the CSV file. An attacker can store a formula-like string (e.g., "=cmd|'/c calc'!A1") in a database field; when an administrator exports the data and opens it in Excel or similar software, the formula is executed. The attack requires user interaction (opening the CSV file in a spreadsheet application) but no authentication. Fixed in version 4.0.0-beta.7 and later.
Affected products
- KeystoneJS Keystone before 4.0.0-beta.7
Timeline
- 2017-11-16: disclosed
- 2017-12-02: patched: Fixed in version 4.0.0-beta.7