Archer Technology RSA Archer Remote Code Execution Vulnerability via CSV Injection

A remote code execution vulnerability exists in Archer Technology RSA Archer version 6.11.00204.10014. The issue arises because the application exports data to CSV without properly escaping cell contents. This flaw allows attackers to inject malicious spreadsheet formulas that execute system commands when the file is opened in a compatible application, such as Microsoft Excel.

Impact

Exploitation of this vulnerability allows for remote code execution on the victim's machine, triggered by opening the crafted CSV file.

Reproduction

To reproduce this vulnerability, access the Device Registration form in Archer RSA. Inject a formula payload, such as one that executes a command like opening the calculator, into the Device Name field. After saving the entry, export the device records to CSV. When the exported file is opened in a spreadsheet application, the injected command will be executed automatically.