EUVD-2025-210058
GHSA-x53x-g43q-33f7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Reflected XSS/CSV injection needs no attacker auth (PR:N) but requires victim action (UI:R); impact is scoped to the victim's session/spreadsheet, so S:C with C:L/I:L and no availability effect, disputing the vendor's C:H/I:H/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters. .
AnalysisAI
Reflected cross-site scripting and CSV formula injection in HCL iControl 4.0.0 let a remote attacker embed unsanitized input that executes when a victim clicks a crafted link or opens an exported CSV report. Insufficient sanitization of input parameters (CWE-1236) allows malicious script or spreadsheet formulas to run in the victim's browser or spreadsheet application. No public exploit identified at time of analysis, and EPSS is very low (0.04%, 13th percentile), indicating negligible observed exploitation activity.
Technical ContextAI
HCL iControl is an administrative/management component (part of HCL's commerce and infrastructure tooling) that offers a report-export-to-CSV feature and reflects request parameters back into its responses. The root cause is CWE-1236, Improper Neutralization of Formula Elements in a CSV File: attacker-controlled values are written into an exported CSV without neutralizing leading formula characters (=, +, -, @), so spreadsheet software such as Excel or LibreOffice Calc interprets them as executable formulas on open. The same insufficient input sanitization also produces a reflected XSS sink, where parameter values are echoed into an HTML response without encoding, allowing arbitrary JavaScript to run in the user's browser session. The affected build is identified by CPE cpe:2.3:a:hcltech:icontrol:4.0.0.
RemediationAI
Apply the fix described in HCL's advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131041 - patch available per vendor advisory; no exact fixed version number is provided in the available data, so confirm the target build directly with HCL. As compensating controls until patched: for the CSV injection path, prefix or quote any exported field beginning with =, +, -, @, tab, or carriage return so spreadsheet software treats it as literal text (trade-off: alters the appearance of legitimate values starting with those characters), and instruct users to open exported CSVs with formula auto-execution disabled or import them as text. For the reflected XSS path, place iControl behind a WAF rule that blocks script-bearing parameter values and add a restrictive Content-Security-Policy plus output encoding at the proxy (trade-off: overly strict CSP or WAF signatures can break legitimate report functionality). Because both vectors require user interaction, also advise administrators not to follow untrusted iControl links.
HCL iControl's web interface fails to automatically expire user sessions after inactivity, leaving authenticated session
Missing HTTP security response headers in HCL iControl fail to instruct client browsers to engage their built-in XSS fil
Weak input validation in HCL iControl allows authenticated remote attackers to submit input of an unexpected type, resul
Stack trace disclosure in HCL iControl v4.0.0 exposes internal application details to authenticated remote attackers via
HCL iControl exposes session cookies without the Secure or SameSite attributes set, and with the cookie path scoped to r
Share
External POC / Exploit Code
Leaving vuln.today