Full Report
CERT Polska has received a report about 2 vulnerabilities (CVE-2026-56651 and CVE-2026-56652) found in dool software.
Analysis Summary
# Vulnerability: Multiple Flaws in Dool Monitoring Software
## CVE Details
- **CVE ID:** CVE-2026-56651
- **CVSS Score:** Not explicitly provided in the source (typically Medium/High for local privilege escalation/data destruction)
- **CWE:** CWE-59 (Improper Link Resolution Before File Access - 'Link Following')
- **CVE ID:** CVE-2026-56652
- **CVSS Score:** Not explicitly provided in the source (typically Medium for client-side execution)
- **CWE:** CWE-1236 (Improper Neutralization of Formula Elements in a CSV File)
## Affected Systems
- **Products:** dool (a performance monitoring tool)
- **Versions:** All versions through 1.3.8
- **Configurations:**
- For CVE-2026-56651: Use of the `--devel` flag.
- For CVE-2026-56652: Exporting data to CSV files.
## Vulnerability Description
**CVE-2026-56651 (Symlink Following):** The application fails to use the `O_NOFOLLOW` flag when opening log files in development mode. This allows a local attacker to create a symbolic link at the expected log path. If `dool` is executed (especially with elevated privileges), it will follow the link and overwrite/truncate the target file with log data.
**CVE-2026-56652 (CSV Injection):** The application does not sanitize data before exporting to CSV format. Specifically, it fails to neutralize special formula characters (`=`, `+`, `-`, or `@`). If a malicious process is running with a name crafted to include these characters, `dool` will record that process name into the CSV, leading to potential command execution when the CSV is opened in spreadsheet software (e.g., Excel, LibreOffice).
## Exploitation
- **Status:** PoC availability implied by report; no evidence of exploitation in the wild provided.
- **Complexity:** Low
- **Attack Vector:** Local (Requires the ability to create symlinks or start processes on the local system).
## Impact
- **Confidentiality:** Low (CVE-2026-56652 may lead to data exfiltration via spreadsheet formulas).
- **Integrity:** High (CVE-2026-56651 allows overwriting sensitive system files).
- **Availability:** High (CVE-2026-56651 can be used to truncate critical system configuration or binary files).
## Remediation
### Patches
Users should update to versions incorporating the following fixes:
- **CVE-2026-56651:** Addressed in Pull Request [#116](https://github[.]com/scottchiefbaker/dool/pull/116).
- **CVE-2026-56652:** Addressed in Pull Request [#117](https://github[.]com/scottchiefbaker/dool/pull/117).
### Workarounds
- Avoid using the `--devel` flag when running `dool` with elevated privileges.
- Do not open CSV exports from `dool` in spreadsheet applications on untrusted systems, or ensure spreadsheet "Automatic Formula Execution" is disabled.
## Detection
- **Indicators of Compromise:**
- Presence of unexpected symbolic links in directories where `dool` writes logs.
- Entries in `dool` CSV exports containing suspicious formulas starting with `=`, `@`, or `+`.
- **Detection methods and tools:** Monitor for unusual process names (e.g., `=SUM(...)`) and audit file system activity for `dool` if the `--devel` flag is frequently used.
## References
- CERT Polska Advisory: [https://cert[.]pl/en/posts/2026/08/vulnerabilities-in-dool-software/](https://cert[.]pl/en/posts/2026/08/vulnerabilities-in-dool-software/)
- CVE-2026-56651: [https://www[.]cve[.]org/CVERecord?id=CVE-2026-56651](https://www[.]cve[.]org/CVERecord?id=CVE-2026-56651)
- CVE-2026-56652: [https://www[.]cve[.]org/CVERecord?id=CVE-2026-56652](https://www[.]cve[.]org/CVERecord?id=CVE-2026-56652)
- GitHub PR 116: [https://github[.]com/scottchiefbaker/dool/pull/116](https://github[.]com/scottchiefbaker/dool/pull/116)
- GitHub PR 117: [https://github[.]com/scottchiefbaker/dool/pull/117](https://github[.]com/scottchiefbaker/dool/pull/117)