Description

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand (stripping commas and joining rows manually) and, unlike the six sibling exports in the same controller, never applies League\Csv\EscapeFormula or honors the config('app.escape_formulas') setting. An authenticated low-privilege user with ordinary create/edit rights on any record whose free-text fields appear in the report (asset name/tag, company name, category, model, or assignee display name) can set such a field to a value beginning with =, +, -, @, tab, or CR. When a user with reports.view privileges requests the export (POST /reports/unaccepted_assets) for a pending checkout acceptance referencing the poisoned record and opens the resulting CSV in Excel, LibreOffice Calc, or Google Sheets, the injected content is evaluated as a formula in the downloader's spreadsheet context, enabling data exfiltration (e.g., HYPERLINK/WEBSERVICE) or, on legacy Windows Excel configurations, DDE command execution. Fixed in 8.7.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-09T14:17:22.820Z",
  "pubdate": "2026-09-09T14:17:22.820Z",
  "executiveSummary": "A CSV Formula Injection vulnerability exists in Snipe-IT versions through 8.6.3, specifically within the unaccepted assets reporting feature.\nThe vulnerability allows an authenticated user with standard create/edit permissions to inject malicious spreadsheet formulas into record fields such as asset names, company names, or category descriptions.\nWhen a privileged user exports these records via the 'unaccepted assets' report, the resulting CSV file contains un-sanitized input starting with characters like '=', '+', '-', '@', or control characters.\nUpon opening the file in spreadsheet software like Microsoft Excel, LibreOffice Calc, or Google Sheets, the application evaluates the injected content as an active formula.\nThe primary security impact includes unauthorized data exfiltration via functions such as HYPERLINK or WEBSERVICE and the potential for remote code execution (RCE) on legacy Windows Excel configurations leveraging Dynamic Data Exchange (DDE).\nThis vulnerability stems from a failure to apply standard CSV sanitization practices, specifically the League\\Csv\\EscapeFormula utility, which is correctly utilized in other report modules within the same controller.",
  "technicalDetails": "The vulnerability is located in the ReportsController::postAssetAcceptanceReport method within the Snipe-IT codebase. Unlike other reporting functions in the same controller, this method manually constructs CSV output by concatenating string values without applying necessary output encoding or sanitization.\nThe root cause is the omission of the League\\Csv\\EscapeFormula class and the lack of enforcement of the application-wide configuration setting 'app.escape_formulas'. This creates a discrepancy where the application fails to neutralize formula-triggering characters (e.g., =, +, -, @, TAB, CR) in free-text fields.\nAn attacker with low-privilege access can manipulate record fields such as 'asset name', 'asset tag', 'company name', 'category', 'model', or 'assignee display name'. By prepending a formula-triggering character to these fields, the attacker poisons the underlying database entries.\nThe attack flow proceeds as follows: 1) The attacker injects a malicious payload into a supported record field. 2) A user with 'reports.view' privileges executes the 'POST /reports/unaccepted_assets' request to generate the CSV export. 3) The server generates a raw CSV containing the attacker-controlled input. 4) The victim downloads and opens the CSV in a spreadsheet application. 5) The spreadsheet software interprets the leading character as a formula indicator and executes the malicious payload.\nThe impact is significant: the payload is executed within the context of the victim's spreadsheet application. Through functions like WEBSERVICE, an attacker can exfiltrate sensitive local data or interact with internal network resources, bypassing traditional network perimeters. In legacy environments where DDE is enabled in Excel, the payload can be crafted to execute arbitrary shell commands, leading to full workstation compromise.\nThis flaw is specific to the 'unaccepted assets' report; other exports in the controller are protected, indicating an inconsistent application of security controls across the reporting infrastructure.\nThe vulnerability is confirmed to be resolved in Snipe-IT version 8.7.0, where appropriate sanitization logic is implemented to neutralize CSV formula injection risks."
}