brunoteixeira1996/cve-2023-36250

CVE-2023-36250

CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new record.

Vulnerability Type

CSV Injection

Discoverer

Bruno Teixeira

Reference

http://gnome.com

Affected Product Code Base

GNOME time tracker v3.0.2

PoC

Creating a new record using a fomrula (=3+3) in the cmdline field, creates a way to inject formulas when exporting to .tsv. With this, when someone extract this .tsv file, the sheet software will evaluate as a valid formula and it will execute it. Note that this is just a sum operation but it's possible to load software that resides on the victim machine, or even create a malicious hyperlink.

cve-2023-36250's Issues

This CVE seems invalid

One of the hamster upstream maintainers here. We've heard about this issue through Debian and investigated. As far as we can tell, this is not actually a security issue in hamster (and probably not a security issue at all).

If you disagree, please elaborate on the issue.

If you agree, can we update the CVE accordingly?