CVE-2024-31892: IBM Storage Scale Auth Bypass Vulnerability

CVE-2024-31892 Overview

CVE-2024-31892 affects IBM Storage Scale GUI versions 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1. The vulnerability stems from improper neutralization of formula elements in CSV files exported by the GUI. An attacker who intercepts and modifies a generated CSV file can embed malicious formulas. When a user opens the manipulated CSV in a spreadsheet application, the formulas execute and perform unauthorized actions in the user's context.

Critical Impact
Successful exploitation enables attackers to execute commands within the spreadsheet client, leading to data exfiltration, credential theft, or local code execution through formula-driven payloads.

Affected Products

IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6
IBM Storage Scale GUI 5.2.0.0 through 5.2.1.1
Linux Kernel based deployments of IBM Storage Scale

Discovery Timeline

2024-12-14 - CVE-2024-31892 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31892

Vulnerability Analysis

The IBM Storage Scale GUI generates CSV exports without sanitizing cell content that begins with formula trigger characters such as =, +, -, and @. This class of issue is commonly known as CSV injection or Formula Injection. When the CSV is opened in Microsoft Excel, LibreOffice Calc, or Google Sheets, those characters cause the spreadsheet engine to interpret the cell as a formula rather than literal text.

An attacker positioned to intercept the CSV in transit can inject crafted payloads. Payloads commonly leverage HYPERLINK, WEBSERVICE, DDE, or IMPORTXML style functions to exfiltrate data, fetch remote content, or trigger command execution via legacy Dynamic Data Exchange behavior.

The issue is tracked under [CWE-89] in the NVD record, though the underlying root cause aligns with improper neutralization of formula elements in spreadsheet output.

Root Cause

The GUI export routine writes raw field values into CSV rows without prefixing untrusted strings that begin with formula trigger characters. There is no escaping with a leading single quote, tab, or other neutralizer before serialization. Trust is incorrectly placed on the downstream consumer of the CSV file.

Attack Vector

Exploitation requires user interaction and a network position to intercept or modify the exported CSV. The attacker tampers with the file in transit or at rest, inserts a formula payload into one or more cells, and waits for an administrator or operator to open the file in a spreadsheet application. Execution then occurs on the victim's workstation, outside the IBM Storage Scale GUI itself.

The vulnerability is described in the IBM Security Support Page.

Detection Methods for CVE-2024-31892

Indicators of Compromise

CSV files exported from IBM Storage Scale GUI containing cells that start with =, +, -, or @ followed by spreadsheet functions such as HYPERLINK, WEBSERVICE, IMPORTXML, or cmd|.
Outbound network connections from workstations to unknown hosts immediately after a user opens a Storage Scale CSV export.
Spawned child processes from excel.exe, soffice.bin, or similar spreadsheet binaries that launch cmd.exe, powershell.exe, or /bin/sh.

Detection Strategies

Inspect CSV exports at email and web gateways for cells beginning with formula trigger characters.
Hunt endpoint telemetry for process chains where a spreadsheet application is the parent of a shell or scripting interpreter.
Correlate file-open events on .csv artifacts from Storage Scale with subsequent DNS lookups or HTTP requests to external domains.

Monitoring Recommendations

Log and review all CSV export actions performed through the IBM Storage Scale GUI.
Alert on DDE-related registry or configuration changes on workstations used by storage administrators.
Track versions of IBM Storage Scale GUI deployed across the environment to identify unpatched hosts.

How to Mitigate CVE-2024-31892

Immediate Actions Required

Identify all IBM Storage Scale GUI instances running versions 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1.
Apply the fixed releases referenced in the IBM advisory at the earliest maintenance window.
Restrict who can generate and distribute CSV exports until patches are deployed.

Patch Information

IBM has published remediation guidance for CVE-2024-31892 on the IBM Security Support Page. Upgrade to the fixed Storage Scale releases listed in that advisory. No exploit is publicly available and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog, but the EPSS score of 0.319% should not be treated as a justification to defer patching.

Workarounds

Disable Dynamic Data Exchange and automatic formula evaluation in spreadsheet applications used by administrators.
Configure Microsoft Excel and LibreOffice Calc to open CSV files in text-only or protected view by default.
Transmit CSV exports over integrity-protected channels and verify file hashes before opening.
Train operators to import CSV files using the spreadsheet's text import wizard rather than double-click open.

bash

# Example: import CSV as text in LibreOffice from the command line
soffice --infilter="CSV:44,34,76,1,,0,false,false" --view storage_scale_export.csv