CVE-2023-46400
Published: 23 January 2025
Summary
CVE-2023-46400 is a critical-severity Improper Neutralization of Formula Elements in a CSV File (CWE-1236) vulnerability in Kwhotel Kwhotel. Its CVSS base score is 9.8 (Critical).
Operationally, ranked at the 30.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely identification, reporting, and correction of the specific CSV formula injection flaw in KWHotel's add guest function.
SI-15 mandates filtering of information output to prevent malicious formulas from being embedded in CSV files generated by the add guest function.
SI-10 enforces validation of inputs to the add guest function, rejecting malicious payloads that could lead to formula injection in CSV exports.
NVD Description
KWHotel 0.47 is vulnerable to CSV Formula Injection in the add guest function.
Deeper analysisAI
KWHotel version 0.47 is affected by CVE-2023-46400, a CSV Formula Injection vulnerability present in the add guest function. This flaw, associated with CWE-1236, carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact across confidentiality, integrity, and availability.
The vulnerability can be exploited by any unauthenticated attacker with network access, requiring low complexity and no user interaction. Exploitation involves injecting malicious formulas into CSV output generated by the add guest function, potentially leading to arbitrary code execution when the file is processed by spreadsheet applications.
Advisories and further technical details are available in the referenced GitHub gist at https://gist.github.com/6en6ar/5d39374d6ced8acbe489e0b1b932d056. Security practitioners should consult this source for exploitation proofs, patch information, or workarounds specific to KWHotel deployments.
Details
- CWE(s)