Loading...
Skip to main content
GeekWala

CVE-2023-51763 — Vulnerability in activeadmin — CVE Details

MEDIUM

ActiveAdmin CSV Injection leading to sensitive information disclosure

Published December 28, 2023Updated February 16, 2024Source: osv

Summary

### Impact In ActiveAdmin versions prior to 3.2.0, maliciously crafted spreadsheet formulas could be uploaded as part of admin data that, when exported to a CSV file and the imported to a spreadsheet program like libreoffice, could lead to remote code execution and private data exfiltration. The attacker would need privileges to upload data to the same ActiveAdmin application as the victim, and would need the victim to possibly ignore security warnings from their spreadsheet program. ### Patches Versions 3.2.0 and above fixed the problem by escaping any data starting with `=` and other characters used by spreadsheet programs. ### Workarounds Only turn on formula evaluation in spreadsheet programs when importing CSV after explicitly reviewing the file. ### References https://owasp.org/www-community/attacks/CSV_Injection https://github.com/activeadmin/activeadmin/pull/8167

Advisory Timeline

  • First published December 28, 2023 (1019 days ago).
  • Last revised February 16, 2024 — 50 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Bundler
Update activeadmin to 3.2.0 or later
gem install activeadmin -v 3.2.0

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: rubygems (1).

PackageEcosystemAffectedFixed In
activeadmin
rubygems
0.1.0, 0.1.1, 0.2.0, 0.2.1 (+63 more)3.2.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 5.2 score means for each attack dimension.

Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

References

Frequently Asked Questions

What is CVE-2023-51763?
ActiveAdmin CSV Injection leading to sensitive information disclosure This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 5.2/10).
How do I check if my project is affected by CVE-2023-51763?
CVE-2023-51763 affects activeadmin. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-51763 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
5.2

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-xhvv-3jww-c487

Related CVEs

More RubyGems advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies