CVE-2020-5299: 
PHP vulnerability analysis and mitigation

CVE-2020-5299 affects OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466. The vulnerability allows users with specific permissions to introduce CSV injection into data that could be exported as CSV files through the ImportExportController, potentially causing the generated CSV export file to be malicious (GitHub Advisory).

The vulnerability exists in the CSV export functionality of OctoberCMS. When exporting data as CSV, the application failed to properly sanitize formula-starting characters (=, -, +, @) in the exported data. This could allow malicious data to be interpreted as formulas by spreadsheet applications. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L) by NVD (NVD).

If successfully exploited, an attacker could execute arbitrary commands on the victim's computer when the CSV file is opened in a spreadsheet application. For example, an attacker could craft a payload that downloads and executes malicious files on the victim's system when the CSV is opened (Full Disclosure).

The vulnerability requires multiple conditions to be met for successful exploitation: 1) The attacker must have permission to modify data that can be exported as CSV, 2) There must be a vulnerability in the victim's spreadsheet software, 3) The attacker must convince the victim to export the malicious data as CSV and open it in vulnerable spreadsheet software while bypassing security warnings (GitHub Advisory).

The vulnerability has been patched in OctoberCMS Build 466 (v1.0.466). For users unable to upgrade, a temporary workaround involves manually applying patches from octobercms/library@c84bf03 and 802d8c8. The fix implements proper CSV formula escaping using the League\CSV library to prevent formula injection (GitHub Commit).