Arbitrary Code Execution Affecting grumpydictator/firefly-iii package, versions <6.1.7


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of concept

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Arbitrary Code Execution vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-PHP-GRUMPYDICTATORFIREFLYIII-6227581
  • published5 Feb 2024
  • disclosed31 Jan 2024
  • creditDaniel Abay

Introduced: 31 Jan 2024

CVE NOT AVAILABLE CWE-94  (opens in a new tab)

How to fix?

Upgrade grumpydictator/firefly-iii to version 6.1.7 or higher.

Overview

grumpydictator/firefly-iii is a personal finances manager.

Affected versions of this package are vulnerable to Arbitrary Code Execution via the Export Data feature which generates a CSV file. An attacker can execute arbitrary commands on a user's machine by entering a specially crafted payload into one of the fields, which is then executed when the CSV file is opened with Excel or other software that supports macros.

Note:

This is only exploitable if a user downloads and opens a CSV file containing the malicious payload on their local machine.

CVSS Scores

version 3.1