Revive Adserver · Report #3859000
Formula injection in conversion tracking report export
Summary
Description
HackerOne community member BapToutatis has reported spreadsheet formula injection in conversion-tracking report exports. An unauthenticated attacker can submit conversion values that are subsequently written as formulas rather than text in an XLS report. Opening the exported workbook in a spreadsheet application can evaluate attacker-supplied formulas. The confirmed impact is formula execution within the workbook; disclosure of information to the attacker has not been established.
Resolution
Conversion values are sanitised before being written to the affected XLS report sections, preventing them from being interpreted as formulas.
Security advisory
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.