CVE-2023-51763

The vulnerability (CWE-1236) consists of the lack of proper sanitization of input data before placing it in the generated CSV file. An attacker can introduce data containing special characters (e.g., =, +, -, @) that initiate formulas in programs such as Microsoft Excel or LibreOffice Calc. When an administrator or other user opens the exported CSV file, the spreadsheet application may automatically execute the embedded formula, which can result in, for example, execution of system commands or data leakage.

An attacker can cause malicious code execution on the client side of a user opening a CSV file and potentially lead to sensitive data leakage or compromise of the victim's system. The high CVSS score (9.8) reflects the possibility of breaching confidentiality, integrity, and availability without the need for authentication.

ActiveAdmin should be updated to version 3.2.0 or later, which contains the fix introduced in commit 697be2b183491beadc8f0b7d8b5bfb44f2387909. The patch is available in the official GitHub repository of the project and is described in the v3.2.0 release.

ActiveAdmin (Active Admin) in all versions before 3.2.0