CWE-1236Improper Neutralization of Formula Elements in a CSV File

Description

Common consequences· 1

• Confidentiality — Read Application Data, Execute Unauthorized Code or Commands
  Attackers can populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software. Note that current versions of Excel warn users of untrusted content.

Potential mitigations· 3

• [Implementation]When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
• [Implementation]If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
• [Architecture and Design]Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.

(incoming)9

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.