2

I have found a nice macro injection vulnerability in an Excel export functionality. I can inject =1+1 (or worse) into the exported Excel file.

But when opening the file in Excel the formula isn't directly evaluated at startup, it is shown as text. Only after someone double clicks the cell and presses enter is the formula evaluated and the content of the cell changes to 2 (or calc starts up depending on the payload).

I only have access to "newer" versions of Excel (2010 and 365). The Excel versions that I tried have automatic function evaluation on (so normally a function is evaluated directly). The installs are default installations, not super secure.

I think this is still a vulnerability that needs to be fixed, but if it only works when a user does something stupid, then the risk would be something like Medium. While if it would execute directly when opening the file (with a pop-up or whatever) it would be a critical vulnerability that needs to be solved ASAP.

My question is: Is this something that all versions of Excel do? (showing the formula in text and not evaluating automatically). Or would it still be critical in older versions, but new versions need more user input?

Bonus question: Does anyone now a payload that would overwrite this "non evaluate at startup" annoying functionality?

EDIT: Ok after a comment by schroeder I get that this might not be construed as purely security. So let us focus on this part of the exploit: How could I leverage this vulnerability into an exploit? Are there ways to trick people into clicking on the cells and evaluating the functions?

  • Testing your vuln in other versions is kind of your job. – schroeder Mar 27 '17 at 11:10
  • @schroeder Ok fair enough, then my question would be how to set up an excel testing lab for a range of older versions. Please do understand that I am not working for a very large company that can just buy licenses for everything just for testing purposes. – Wealot Mar 27 '17 at 11:13
  • I am unaware of any free options to try out old versions of Excel. This really isn't a security question. You might find help on other forums where people have the versions you need. – schroeder Mar 27 '17 at 11:17
  • @schroeder Ok, I posted on another forum as well about the versions, but I am still very much interested in possible workarounds (which are very security related). How can I leverage this vulnerability to exploit a not to tech savy user? – Wealot Mar 27 '17 at 11:43
  • It's still not on topic. You are asking us how to leverage what you found into an exploit. Again, this is kind of your job. You have half a finding, and what us to bring it home. – schroeder Mar 27 '17 at 12:36
1

Responsibly report your findings to the program's author, and they will do regression testing on all supported versions. It's not your responsibility to do their testing for them.

Unfortunately, I don't think Microsoft's Bug Bounty program extends to their Office products. But you never know; if you can produce an example exploit then it may become a security issue they're willing to pay for.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.