Is CVE-2017-15879 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-15879 being exploited in the wild.

How severe is CVE-2017-15879?

Low severity, with a CVSS score of 3, published 16 November 2017.

Which products and versions are affected?

keystone (npm) SEMVER:introduced=0,fixed=4.0.0-beta7.

Is there a fix for CVE-2017-15879?

Yes. keystone (npm): upgrade to 4.0.0-beta7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-15879 attacked?

It is attacked over the network.

Am I affected by CVE-2017-15879?

Check whether you run keystone (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-15879: KeystoneJS CSV injection in export

CVE-2017-15879 · Severity: low · CVSS 3 · Published 2017-11-16

KeystoneJS is a Node.js web application framework that includes admin interfaces and data management features. An attacker can inject malicious formulas into CSV export files that, when opened in spreadsheet applications like Excel, execute arbitrary code on a user's computer—a technique known as CSV injection or formula injection.

Technologies: keystone (npm). Vendors: npm.

Quick answers

Is CVE-2017-15879 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-15879 being exploited in the wild.
How severe is CVE-2017-15879?: Low severity, with a CVSS score of 3, published 16 November 2017.
Which products and versions are affected?: keystone (npm) SEMVER:introduced=0,fixed=4.0.0-beta7.
Is there a fix for CVE-2017-15879?: Yes. keystone (npm): upgrade to 4.0.0-beta7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-15879 attacked?: It is attacked over the network.
Am I affected by CVE-2017-15879?: Check whether you run keystone (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

keystone (npm): upgrade to 4.0.0-beta7 or later
```
npm install keystone@4.0.0-beta7
```

Technical details

CSV Injection (CWE-20: Improper Input Validation) exists in the CSV export functionality of KeystoneJS versions prior to 4.0.0-beta.7, specifically in admin/server/api/download.js and lib/list/getCSVData.js. When a user exports data to CSV format, untrusted values in database fields are not sanitized before being written to the CSV file. An attacker can store a formula-like string (e.g., "=cmd|'/c calc'!A1") in a database field; when an administrator exports the data and opens it in Excel or similar software, the formula is executed. The attack requires user interaction (opening the CSV file in a spreadsheet application) but no authentication. Fixed in version 4.0.0-beta.7 and later.

Affected products

KeystoneJS Keystone before 4.0.0-beta.7

Identifiers

CVE-2017-15879
GHSA-6494-v9fq-fgq2

Timeline

2017-11-16: disclosed
2017-12-02: patched: Fixed in version 4.0.0-beta.7

References

https://github.com/keystonejs/keystone/pull/4478

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.