CVE-2024-47485: Hikvision HikCentral Master RCE Vulnerability

CVE-2024-47485 Overview

A CSV injection vulnerability exists in certain versions of HikCentral Master Lite, a video surveillance management platform developed by Hikvision. This vulnerability allows an attacker to craft malicious data that, when exported to a CSV file and subsequently opened in a spreadsheet application, can generate and execute arbitrary commands on the victim's system.

CSV injection, also known as formula injection, occurs when user-controlled input is included in exported CSV files without proper sanitization. When the CSV file is opened in applications like Microsoft Excel or LibreOffice Calc, specially crafted payloads containing formula characters (such as =, +, -, or @) can be interpreted as executable formulas, leading to command execution on the local system.

Critical Impact

Successful exploitation could allow attackers to execute arbitrary commands on systems where exported CSV files are opened, potentially leading to data theft, malware installation, or further system compromise.

Affected Products

• HikCentral Master Lite (various versions)
• Hikvision HikCentral Master (Lite edition)

Discovery Timeline

• 2024-10-18 - CVE-2024-47485 published to NVD
• 2025-03-13 - Last updated in NVD database

Technical Details for CVE-2024-47485

Vulnerability Analysis

This vulnerability is classified under CWE-1236 (Improper Neutralization of Formula Elements in a CSV File). The flaw resides in the data export functionality of HikCentral Master Lite, where user-supplied input is incorporated into CSV file exports without adequate sanitization of special characters that spreadsheet applications interpret as formula indicators.

The attack requires network access and user interaction, as the victim must open the malicious CSV file in a spreadsheet application that supports Dynamic Data Exchange (DDE) or formula execution. While the vulnerability itself does not directly compromise the HikCentral Master Lite application, it enables attackers to pivot to attacking downstream systems where exported data is processed.

Root Cause

The root cause of this vulnerability is improper input validation and output encoding in the CSV export functionality. When generating CSV files, the application fails to properly escape or sanitize cell values that begin with formula indicator characters (=, +, -, @, \t, \r). This allows attackers to inject malicious formulas that execute when the file is opened in vulnerable spreadsheet applications.

Attack Vector

The attack follows a multi-stage process:

1. An attacker submits malicious input containing formula payloads through the HikCentral Master Lite interface
2. The malicious data is stored in the application database
3. When an administrator or user exports data to CSV format, the malicious payload is included without sanitization
4. The victim opens the CSV file in a spreadsheet application
5. The spreadsheet application interprets the payload as a formula and executes embedded commands

Typical payloads may leverage DDE (Dynamic Data Exchange) or hyperlink functions to execute arbitrary commands. For example, a malicious payload might invoke system commands through Excel's DDE functionality when the CSV is opened.

Detection Methods for CVE-2024-47485

Indicators of Compromise

• Presence of formula indicator characters (=, +, -, @) at the beginning of user-submitted data fields in the HikCentral Master Lite database
• Unusual CSV export requests or patterns from user accounts
• Reports of unexpected command execution or security warnings when opening exported CSV files
• Suspicious DDE or PowerShell activity triggered after opening spreadsheet files

Detection Strategies

• Implement input monitoring to detect submission of data containing potential CSV injection payloads
• Configure endpoint detection rules to alert on DDE execution from spreadsheet applications
• Monitor for suspicious process spawning from Microsoft Excel, LibreOffice Calc, or similar applications
• Review audit logs for unusual data export activities from HikCentral Master Lite

Monitoring Recommendations

• Enable logging for all data export operations in HikCentral Master Lite
• Configure SIEM rules to correlate CSV file exports with subsequent suspicious endpoint activity
• Implement file integrity monitoring on systems that process exported CSV files
• Deploy endpoint protection that can detect and block malicious DDE execution

How to Mitigate CVE-2024-47485

Immediate Actions Required

• Review the Hikvision Security Advisory for specific patch information and affected versions
• Apply the latest security patches provided by Hikvision for HikCentral Master Lite
• Educate users about the risks of opening CSV files from untrusted sources
• Consider disabling DDE functionality in spreadsheet applications used within your organization

Patch Information

Hikvision has released security updates addressing this vulnerability. Administrators should consult the official Hikvision Security Advisory for detailed patching instructions and version-specific guidance. It is recommended to upgrade to the latest available version of HikCentral Master Lite.

Workarounds

• Implement input validation at the application level to reject or sanitize formula indicator characters in user input
• Prefix all cell values with a single quote (') when generating CSV exports to prevent formula interpretation
• Configure Microsoft Excel to disable DDE by navigating to File → Options → Trust Center → Trust Center Settings → External Content and disabling DDE
• Use CSV files only with text editors or applications that do not interpret formulas until patches can be applied
• Implement strict access controls to limit who can export data from HikCentral Master Lite

Organizations should implement defense-in-depth measures by combining application patching with endpoint protection and user education to mitigate the risk of CSV injection attacks.