CWE-1236: Improper Neutralization of Formula Elements in a CSV File
CWE版本: 4.18
更新日期: 2025-09-09
弱点描述
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
扩展描述
User-provided data is often saved to traditional databases. This data can be exported to a CSV file, which allows users to read the data using spreadsheet software such as Excel, Numbers, or Calc. This software interprets entries beginning with '=' as formulas, which are then executed by the spreadsheet software. The software's formula language often allows methods to access hyperlinks or the local command line, and frequently allows enough characters to invoke an entire script. Attackers can populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software.
常见后果
影响范围: Confidentiality
技术影响: Read Application Data Execute Unauthorized Code or Commands
说明: Current versions of Excel warn users of untrusted content.
潜在缓解措施
阶段: Implementation
描述: When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
有效性: Moderate
阶段: Implementation
描述: If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
有效性: Moderate
阶段: Architecture and Design
描述: Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.
有效性: Limited
观察示例
参考: CVE-2019-12134
Low privileged user can trigger CSV injection through a contact form field value
参考: CVE-2019-4521
Cloud management product allows arbitrary command execution via CSV injection
参考: CVE-2019-17661
CSV injection in content management system via formula code in a first or last name
引入模式
| 阶段 | 说明 |
|---|---|
| Implementation | The weakness is in the implementation of a software's CSV export feature, in particular how it formats formula entries as the output gets flattened into a text file. |