CSV Formula Injection in Actual Finance Tool

Detection Guidance

This vulnerability involves user-controlled strings in exported CSV files that begin with characters such as =, +, -, @, tab, or carriage return being interpreted as formulas in spreadsheet applications. To detect this vulnerability on your system, you can inspect exported CSV files for cells starting with these characters without a neutralizing prefix (such as a single quote).

A practical approach is to search exported CSV files for lines containing fields that start with these special characters. For example, using command-line tools like grep or awk can help identify potentially vulnerable CSV exports.

• Use grep to find lines with fields starting with formula characters: grep -E '^("?)([=+\-@\t\r])' exported_file.csv
• Use awk to print fields starting with formula characters: awk -F',' '{for(i=1;i<=NF;i++) if ($i ~ /^[=+\-@\t\r]/) print $i}' exported_file.csv

If you find such fields without a leading single quote, it indicates the vulnerability is present because the formula prefix neutralization is missing.

Useful 0 Not Useful 0

Executive Summary

The vulnerability exists in the Actual personal finance tool versions prior to 26.6.0. Specifically, the functions exportToCSV and exportQueryToCSV pass user-controlled strings (Payee, Notes, Account, and Category) directly to the csv-stringify library without any neutralization of formula prefixes.

If these strings begin with characters like equals sign (=), plus (+), minus (-), at sign (@), tab, or carriage return, they are preserved verbatim in the exported CSV file. When this CSV file is opened in spreadsheet applications such as Excel, LibreOffice Calc, or Google Sheets, these strings are interpreted as formulas.

This behavior enables attackers to exfiltrate transaction data or manipulate the displayed spreadsheet values by injecting malicious formulas.

The issue was fixed in version 26.6.0 by presumably adding formula-prefix neutralization.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to data exfiltration and manipulation when CSV exports from the Actual finance tool are opened in spreadsheet software.

An attacker can craft malicious input strings that, when exported and opened, execute formulas in the spreadsheet application. This can result in unauthorized disclosure of sensitive transaction data or altered display of financial information.

Such impacts can compromise the confidentiality and integrity of your financial data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the Actual personal finance tool to version 26.6.0 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows user-controlled strings to be interpreted as formulas in exported CSV files, which can lead to transaction data exfiltration and manipulation of spreadsheet display values.

This data exfiltration risk could potentially impact compliance with data protection regulations such as GDPR and HIPAA, which require safeguarding personal and sensitive information from unauthorized access or disclosure.

However, the provided information does not explicitly describe the direct effects on compliance with these standards.

Useful 0 Not Useful 0