Axosoft Scrum CSV Injection Leading to RCE

Vendor of the product: Axosoft LLC Product name: Axosoft Scrum and Bug Tracking Version: 22.1.1.11545 Affected Component: Tickets Discoverer: Nakul Singh Vulnerability Name CSV Injection Description Axosoft contains a CSV injection vulnerability which allows an attacker to perform remote code execution. A low-privileged attacker can edit a ticket and inject a payload into the title field. When an administrator accesses the tickets list and exports the data to CSV format, then opens the file, the payload is executed, granting the attacker a reverse shell on the administrator’s machine. Impact The impact of a CSV injection vulnerability can be severe, as an attacker could exploit it to execute arbitrary code, compromise sensitive data, or manipulate the application’s behavior. If the infected CSV file is opened in spreadsheet software, it triggers the execution of malicious commands. This could lead to unauthorized access, data leakage, or other malicious activities, posing a significant risk to the security and integrity of the affected system. Mitigation To prevent CSV injection vulnerabilities, it is essential to implement proper input validation and sanitization. Developers should validate user input to ensure it conforms to expected formats and does not contain malicious content. Additionally, special characters—particularly those with special meaning in CSV files (such as equals sign, plus sign, etc.)—should be properly escaped or sanitized. CVSS CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Goal Reached Thanks to every supporter — we hit 100%!

Axosoft Scrum CSV Injection Leading to RCE