CVE-2024-55532

The vulnerability lies in the failure to properly neutralize so-called formula elements before placing data in the generated CSV file. A malicious user can introduce data into the system containing formulas or commands (e.g., starting with characters '=', '+', '-', '@'), which will be embedded in the exported CSV file. When a victim opens such a file in a spreadsheet application (e.g., Microsoft Excel, LibreOffice Calc), the application may automatically execute the contained formulas, including system commands or references to external resources.

An attacker can cause malicious code to be executed on the workstation of a victim who opens an infected CSV file, which may result in data theft, compromise of confidentiality, integrity, and availability of the user's resources.

Apache Ranger should be updated to version 2.6.0 or later, which eliminates this vulnerability. Details are available on the vendor's website: https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger

Apache Ranger in all versions below 2.6.0