GHSA-mqjc-x563-c9q8: 
PHP vulnerability analysis and mitigation

A CSV Excel Macro Injection vulnerability (GHSA-mqjc-x563-c9q8) was discovered in the SilverStripe framework affecting versions >= 3.5.0-rc1, < 3.5.6, >= 3.6.0-rc1, < 3.6.3, and >= 4.0.0-rc1, < 4.0.1. The vulnerability was discovered by Ishaq Mohammed and disclosed on December 7, 2017. The issue affects the CSV export feature of the CMS where output could contain potentially executable macros and scripts (Silverstripe Advisory).

The vulnerability exists in the CSV export functionality where cell values could contain macros and scripts that may be executed when imported into software like Microsoft Excel. The issue has been assigned a High severity rating with a CVSS v3.1 score of 8.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). The vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) (GitHub Advisory).

If exploited, this vulnerability could allow malicious macros and scripts to be executed when the exported CSV files are imported into applications like Microsoft Excel, potentially leading to unauthorized code execution with high impact on confidentiality, integrity, and availability of the affected system (GitHub Advisory).

The vulnerability requires network access and user interaction (importing the CSV file) to exploit. While the attack complexity is considered low, it does require low-level privileges to execute (GitHub Advisory).

The issue has been fixed in versions 3.5.6, 3.6.3, and 4.0.1. The fix involves prepending a literal tab character to all potentially executable cell values exported from CSV to prevent macro execution. Organizations should upgrade to the patched versions. For those unable to upgrade immediately, the XLS export sanitization can be controlled through a configuration setting (Silverstripe Advisory).