UPDATE 1st October 2018 : This note has been re-released with updated ‘Correction Instructions’ and ‘ Support Packages & Patches’ . Additionally CVSS information is also made available.

Comma Separated Values (CSC) format

When exporting the data displayed in an FPM List UIBB ATS or FPM Tree UIBB component by means of the standard function Export To Spreadsheet in the Comma Separated Values (CSV) format, the data might have been prepared accordingly before by an attacker, in order to embed formulas that invoke executable code on the client machine, on which the result file is opened. If for example the result file is opened by means of Microsoft Excel, the following warning is displayed:

“Microsoft Office has identified a potential security concern. Automatic update of links has been disabled. If you choose to enable automatic update of links, your computer may no longer be secure. Do not enable this content unless you trust the source of this file.

[Enable]    [Disable]”

If an end-user then chooses the [Enable] option, the embedded contents in shape of potentially malicious formulas, are automatically executed.

Mitigation
The mentioned warning is always displayed upon opening a CSV file in Microsoft Excel, hence in case an end-user then chooses the [Disable] option, the file can nonentheless be opened, the embedded, potentially malicious formulas, are however then not automatically executed.

Office Open XML (Microsoft Excel) format
When exporting the data displayed in an FPM List UIBB ATS, FPM Tree UIBB or WD ABAP ALV component by means of the standard function Export To Spreadsheet in the Office Open XML (Microsoft Excel) format (Export to Microsoft Excel in the WD ABAP ALV end-user terminology), the data might have been prepared accordingly before by an attacker, in order to embed formulas that invoke executable code on the client machine, on which the result file is opened. If for example the result file is opened by means of Microsoft Excel, the following warning is displayed:

“Microsoft Office has identified a potential security concern.

Automatic update of links has been disabled. If you choose to enable automatic update of links, your computer may no longer be secure. Do not enable this content unless you trust the source of this file.

[Enable]    [Disable]”

If an end-user then chooses the [Enable] option, the embedded contents in shape of potentially malicious formulas, are however not automatically executed. To actually execute these formulas, an end-user has to explicitly click into the respective cell, edit it and press the <ENTER> key. Afterwards a second warning is displayed:

“Remote data not accessible.

To access the data Excel needs to start another application. Some legitimate applications on your computer could be used maliciuously to spread viruses or damage your computer. Only click Yes if you trust the source of the workbook and you want to let the workbook start the application.
Start application ‘…’

[Yes]    [No]“

Only if then and end-user clicks [Yes], the respective formula is executed.