Serv-U FTP Server version 15.1.7 suffers from a CSV injection vulnerability.
4b705c0bbe42992ddfdc2fadbd731c13Issue: CSV injection vulnerability
CVE: CVE-2019-13181
Security researcher: Richard Tan @ The Missing Link Security
Product name: Serv-U FTP Server
Product version: Tested on 15.1.7
Fixed in: Serv-U 15.1.7 Hotfix 2
# Overview
The application allowed table entries to contain a string which could be
evaluated by Excel as a Dynamic Data Exchange (DDE) macro.
Privileged users who has the appropriate rights to modify or create users
could insert values into user properties which is evaluated as macros if the
user list is exported as an Excel format.
Steps to reproduce (Proof of concept):
1) Login as a user that has privileges to create or modify users.
2) Create a new user and add the following payload into the
"description" field. "=cmd|'/C calc.exe'!A0"
3) Export the user list with a file name "CSVinjection.csv" on the
application server.
4) On the application server, locate the file and execute it. Notice
that a warning sign could be prompted depending the Excel's security
settings. (If so click enable)
5) Observe that the calculator tool is executed. This is a proof of
concept however an adversary could exploit this weakness to potentially gain
access to the application server (or from where ever the file is executed
from).