Description
OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK(...) matching a cohort, so exported cohort CSVs execute formulas that exfiltrate adjacent cell data.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Openpanel-dev openpanel
Default version status: unaffected
0 to ≤ 2.3.0affected
pkg:github/Openpanel-dev/openpanelReferences
- https://hackmd.io/@haind/openpanel-cohort-csv-formula-injection ↗
- https://github.com/Openpanel-dev/openpanel/blob/7c4d22ae4b6b20fb08eb5c94a0cd3cfebb3d32ca/apps/start/src/utils/csv-download.ts#L1-L29 ↗
- https://github.com/Openpanel-dev/openpanel ↗
- https://www.vulncheck.com/advisories/openpanel-through-2.3.0-csv-formula-injection-via-cohort-member-export ↗