CVE-2019-14749
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1 where CSV formula injection exists in the export spreadsheets functionality. Spreadsheets are generated dynamically from unvalidated user input in the Name and Internal Notes fields in the Users tab, and the Issue Summary field in the tickets tab. This allows agents to download data in .csv or .xls format that may contain malicious formulas.
Risk Assessment
The risk is that end users opening the exported spreadsheet in applications like Excel or OpenOffice Calc may be affected by malicious formulas from an untrusted source. This could lead to unintended actions on the user's computer.
Recommendation
Immediately update osTicket to version 1.10.7 or 1.12.1, which include fixes for this vulnerability. Additionally, consider validating input data before export and educating users about the risks of opening CSV files from unknown sources.
Original NVD description (English source)
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the export spreadsheets functionality. These spreadsheets are generated dynamically from unvalidated or unfiltered user input in the Name and Internal Notes fields in the Users tab, and the Issue Summary field in the tickets tab. This allows other agents to download data in a .csv file format or .xls file format. This is used as input for spreadsheet applications such as Excel and OpenOffice Calc, resulting in a situation where cells in the spreadsheets can contain input from an untrusted source. As a result, the end user who is accessing the exported spreadsheet can be affected.