HCL BigFix Service Management Spreadsheet File Handling Vulnerability Allowing Information Exfiltration

A vulnerability exists in HCL BigFix Service Management (SM) version 23, where the application fails to properly sanitize or securely render spreadsheet files (CSV, XLS, XLSX) before processing or distribution. This oversight could enable an attacker to manipulate data fields in a way that, when the file is opened in spreadsheet software like Excel, could lead to information exfiltration or other malicious activities. Although current versions of Excel provide warnings about untrusted content, this vulnerability could still be exploited.

Impact

Exploitation of this vulnerability could result in unauthorized information exfiltration or execution of malicious activities through manipulated spreadsheet files.

Remediation

Users can upgrade to HCL BigFix Service Management (SM) version 27 to address this vulnerability.