GHSA-pg6j-qf29-gc43: vulnerability in Module ps_emailsubscription

Description

CSV Injection (Formula Injection) in newsletter subscribers export

Impact

The newsletter subscription form accepts email addresses that begin with spreadsheet formula characters (=, +, -, @). Such values pass email validation and are stored as-is.

When a back-office administrator exports the subscriber list to CSV from the module configuration page, these values are written to the file without neutralization. If the file is opened in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, the cell is interpreted as a formula.

An unauthenticated attacker can therefore inject formulas that are evaluated on the administrator's workstation. Depending on the application and its security settings, this can lead to data exfiltration (e.g. HYPERLINK/WEBSERVICE-based leaks of other cells) or, on legacy configurations with DDE enabled, command execution after user confirmation.

Exploitation requires the administrator to download the export and open it in a spreadsheet application, and in most cases to dismiss a security warning.

Proof of concept

1. On the front office, subscribe to the newsletter with the address =calc|a!z|@test.com. 2. In the back office, open the ps_emailsubscription module configuration and export subscribers to CSV. 3. Open the CSV in a spreadsheet application: the email cell starts with = (unquoted) and is interpreted as a formula.

Patches

The issue is fixed in version 3.0.1. Exported values that begin with =, +, -, @, tab (0x09) or carriage return (0x0D) are now prefixed with a single quote so they are treated as text.

Workarounds

Until then, open exported files as plain text or import them with all columns forced to "Text" format. Do not enable DDE / external content execution in spreadsheet applications.
Review existing subscribers for addresses starting with formula characters and delete them.