Improper Neutralization of Formula Elements in a CSV File

Opis

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

Inne nazwy

CSV Injection

Formula Injection

Excel Macro Injection

Skutki

• Confidentiality

  Read Application Data; Execute Unauthorized Code or Commands

  Attackers can populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software. Note that current versions of Excel warn users of untrusted content.

Zapobieganie

• Implementation

  When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).

  Skuteczność: Moderate

• Implementation

  If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.

  Skuteczność: Moderate

• Architecture and Design

  Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.

  Skuteczność: Limited

Przykłady podatności

• CVE-2019-12134 Low privileged user can trigger CSV injection through a contact form field value
• CVE-2019-4521 Cloud management product allows arbitrary command execution via CSV injection
• CVE-2019-17661 CSV injection in content management system via formula code in a first or last name

Słabość nadrzędna

• CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Kiedy powstaje

• Implementation — The weakness is in the implementation of a software's CSV export feature, in particular how it formats formula entries as the output gets flattened into a text file.

Dotyczy

Not Language-Specific, Not OS-Specific, Not Architecture-Specific, Other

Źródła

1. CSV Injection — OWASP, 2020
2. Data Extraction to Command Execution CSV Injection — Jamie Rougvie, 2019
3. The Absurdly Underestimated Dangers of CSV Injection — George Mauer, 2017
4. Comma Separated Vulnerabilities — James Kettle, 2014