CVE-2023-31044: Nokia Impact CSV Injection Vulnerability

CVE-2023-31044 Overview

CVE-2023-31044 is a CSV Injection vulnerability discovered in Nokia Impact Device Management platform. The vulnerability affects Nokia Impact DM versions 19.11 and later, prior to Mobile 23_FP1. A remote authenticated user can exploit the Add Campaign functionality to inject malicious payloads within the Campaign Name field. When the data is exported to a CSV file and opened in spreadsheet software, the injected payload may execute, potentially leading to data exfiltration or other malicious activities.

Critical Impact

Authenticated attackers can inject malicious formulas into CSV exports via the Campaign Name field, enabling potential data exfiltration or code execution when the exported file is opened in spreadsheet applications.

Affected Products

• Nokia Impact DM versions 19.11 and later
• Nokia Impact versions before Mobile 23_FP1

Discovery Timeline

• 2026-03-03 - CVE CVE-2023-31044 published to NVD
• 2026-03-04 - Last updated in NVD database

Technical Details for CVE-2023-31044

Vulnerability Analysis

This vulnerability is classified under CWE-94 (Improper Control of Generation of Code). The Nokia Impact Device Management platform fails to properly sanitize user input in the Campaign Name field within the Add Campaign functionality. When an authenticated user creates a campaign with a specially crafted name containing spreadsheet formula syntax, this malicious input is stored in the system without adequate sanitization.

The attack requires network access and authenticated privileges to the Nokia Impact DM platform. The attacker must have sufficient permissions to access the Add Campaign functionality. Additionally, successful exploitation depends on a victim user exporting the campaign data to CSV format and opening it in spreadsheet software that automatically executes formulas.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding within the Nokia Impact DM application. The Campaign Name field does not properly sanitize or escape characters that are interpreted as formula prefixes by spreadsheet applications (such as =, @, +, -). When these characters are included in exported CSV data without proper escaping, spreadsheet software may interpret them as executable formulas.

Attack Vector

The attack vector is network-based and requires authenticated access to the Nokia Impact DM platform. An attacker must:

1. Authenticate to the Nokia Impact DM system with valid credentials
2. Navigate to the Add Campaign functionality
3. Inject a malicious payload (e.g., spreadsheet formula) into the Campaign Name field
4. Wait for an administrator or user to export campaign data to CSV format
5. The exported CSV file, when opened in spreadsheet software like Microsoft Excel or Google Sheets, may execute the injected formula

This attack chain involves a social engineering component, as it relies on another user opening the exported CSV file in vulnerable spreadsheet software. Common payloads include formulas that attempt to exfiltrate data to external servers or execute local system commands through Dynamic Data Exchange (DDE) mechanisms.

Detection Methods for CVE-2023-31044

Indicators of Compromise

• Unusual campaign names containing formula-like syntax (starting with =, @, +, -)
• Campaign names containing suspicious function calls such as HYPERLINK, IMPORTXML, or WEBSERVICE
• Exported CSV files with unexpected network connections when opened
• Audit logs showing creation of campaigns with encoded or obfuscated payloads

Detection Strategies

• Implement input monitoring on the Add Campaign functionality to flag suspicious characters or patterns
• Review audit logs for campaign creations containing formula injection indicators
• Deploy endpoint protection to monitor for unusual spreadsheet application behavior when opening CSV files
• Configure network monitoring to detect outbound connections initiated by spreadsheet applications

Monitoring Recommendations

• Enable comprehensive logging on Nokia Impact DM to capture all campaign creation activities
• Monitor for CSV exports and correlate with campaign data modifications
• Implement alerting for campaigns created with names matching known CSV injection patterns
• Review user activity logs for accounts creating multiple campaigns with suspicious naming conventions

How to Mitigate CVE-2023-31044

Immediate Actions Required

• Upgrade Nokia Impact to Mobile 23_FP1 or later to remediate this vulnerability
• Review existing campaigns for potential malicious payloads in the Campaign Name field
• Educate users about the risks of opening exported CSV files from untrusted sources
• Implement additional access controls to limit who can create campaigns in the system

Patch Information

Nokia has addressed this vulnerability in the Mobile 23_FP1 release. Organizations using Nokia Impact DM versions 19.11 and later should upgrade to Mobile 23_FP1 or a subsequent patched version. For detailed patch information, consult the Nokia Official Website or contact Nokia support directly. Additional technical analysis is available from the Gruppo TIM Red Team Analysis.

Workarounds

• Implement application-level input validation to block formula injection characters (=, @, +, -) at the beginning of the Campaign Name field
• Configure spreadsheet applications to disable automatic formula execution when opening CSV files
• Prefix all user-supplied data with a single quote (') during CSV export to prevent formula interpretation
• Restrict access to the Add Campaign functionality to trusted users only
• Review and sanitize existing campaign data before any CSV exports

# Example: Disable automatic formula execution in LibreOffice
# Add to ~/.config/libreoffice/4/user/registrymodifications.xcu
# Or configure via Tools > Options > LibreOffice Calc > Formula
# Set "Recalculation on File Load" to "Never Recalculate"

# For Microsoft Excel, configure via Trust Center settings:
# File > Options > Trust Center > Trust Center Settings
# Disable "Enable Dynamic Data Exchange Server Lookup"