← Advisories

Anviz AIM CrossChex Standard 4.3 Excel Macro Injection

Medium
Advisory ID
ZSL-2018-5498
Release Date
01 November 2018
Vendor
Anviz Biometric Technology Co., Ltd. - https://www.anviz.com
Affected Version
4.3.6.0
Tested On
Microsoft Windows 7 Professional SP1 (EN)
Summary

Access Control and Time Attendance Management System. Complying with our self-developed fingerprint, facial, iris, etc. devices, CrossChex Standard integrates intelligent management of time attendance and relevant functions of access control. It has been widely used in many office buildings and factories across the world, continuously serving access control and management requests from many companies with stable performance, accurate calculation, safe management and high intelligence.

Description

CSV (XLS) Injection (Excel Macro Injection or Formula Injection) exists in the AIM CrossChex 4.3 when importing or exporting users using xls Excel file. This can be exploited to execute arbitrary commands on the affected system via SE attacks when an attacker inserts formula payload in the 'Name' field when adding a user or using the custom fields 'Gender', 'Position', 'Phone', 'Birthday', 'Employ Date' and 'Address'. Upon importing, the application will launch Excel program and execute the malicious macro formula.

Proof of Concept
Disclosure Timeline
N/A
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
01.11.2018Initial release
02.11.2018Added reference [1], [2] and [3]
05.11.2018Added reference [4]
21.03.2026Added reference [5]