Executive brief
Snipe-IT is an open-source asset management application used by organizations to track IT inventory and equipment. A vulnerability allows low-privileged users to inject spreadsheet formulas into activity reports by setting a malicious User-Agent header, which execute when an admin or auditor opens the exported CSV file in spreadsheet software, potentially leading to credential theft or malware downloads.
Technical details
This is a CSV formula injection vulnerability (CWE-1236) in Snipe-IT's reporting module. The `Actionlog::logaction()` function stores the HTTP User-Agent header directly in the activity log without sanitization. The `ReportsController::postActivityReport()` method later exports this data using plain `fputcsv()`, which does not escape formula-like content (e.g., strings starting with `=`, `+`, `@`, or `-`). An authenticated attacker with low privileges can craft a malicious User-Agent header containing a formula (e.g., `=HYPERLINK("https://attacker.com/","click")`) and trigger a logged action. When a higher-privileged user (admin or report viewer) exports and opens the Activity Report in Excel, LibreOffice, or similar spreadsheet software, the formula executes, enabling credential harvesting, phishing, or malware distribution. The attack requires authentication and user interaction (opening the CSV file), but network reachable and affects confidentiality and integrity of downstream systems. Patched in version 8.6.2.
Affected products
- grokability Snipe-IT <= 8.6.1
Timeline
- 2026-08-28: disclosed: Published in GitHub Advisory Database (GHSA-whrx-mmgr-gpcf)
- 2026-08-28: patched: Fixed in Snipe-IT v8.6.2