Formula Injection

Attackers might control data written to a spreadsheet, which could enable them to target users who open the file on certain spreadsheet processors.

Popular spreadsheet processors such as Apache OpenOffice Calc and Microsoft Office Excel support powerful formula operations that might enable attackers in control of the spreadsheet to run arbitrary commands on the underlying system or leak sensitive information on the spreadsheet.

As an example, the attacker may inject the following payload as part of a CSV field: =cmd|'/C calc.exe'!Z0. If the user who opens the spreadsheet trusts the origin of the document, they might accept all the security prompts presented by the spreadsheet processor and let the payload (in this example, opening the Windows calculator) run on their system.

Example: The following example shows an ASP.NET Controller that generates a CSV response with non-sanitized user-controlled data:

        public void Service()
        {
             string name = HttpContext.Request["name"];

             string data = GenerateCSVFor(name);
             HttpContext.Response.Clear();
             HttpContext.Response.Buffer = true;
             HttpContext.Response.AddHeader("content-disposition", "attachment;filename=file.csv");
             HttpContext.Response.Charset = "";
             HttpContext.Response.ContentType = "application/csv";
             HttpContext.Response.Output.Write(tainted);
             HttpContext.Response.Flush();
             HttpContext.Response.End();
        }

Attackers might control data written to a spreadsheet, which could enable them to target users who open the file on certain spreadsheet processors.

Popular spreadsheet processors such as Apache OpenOffice Calc and Microsoft Office Excel support powerful formula operations that might enable attackers in control of the spreadsheet to run arbitrary commands on the underlying system or leak sensitive information on the spreadsheet.

As an example, the attacker may inject the following payload as part of a CSV field: =cmd|'/C calc.exe'!Z0. If the user who opens the spreadsheet trusts the origin of the document, they might accept all the security prompts presented by the spreadsheet processor and let the payload (in this example, opening the Windows calculator) run on their system.

Example: The following example writes to a csv file using non-sanitized user-controlled data:

    func someHandler(w http.ResponseWriter, r *http.Request){
        r.parseForm()
        foo := r.FormValue("foo")
        ...
        w := csv.NewWriter(file)
        w.Write(foo)
    }

Attackers might control data written to a spreadsheet, which could enable them to target users who open the file on certain spreadsheet processors.

Popular spreadsheet processors such as Apache OpenOffice Calc and Microsoft Office Excel support powerful formula operations that might enable attackers in control of the spreadsheet to run arbitrary commands on the underlying system or leak sensitive information on the spreadsheet.

As an example, the attacker may inject the following payload as part of a CSV field: =cmd|'/C calc.exe'!Z0. If the user who opens the spreadsheet trusts the origin of the document, they might accept all the security prompts presented by the spreadsheet processor and let the payload (in this example, opening the Windows calculator) run on their system.

Example: The following example shows a Spring Controller that generates a CSV response with non-sanitized user-controlled data:

    @RequestMapping(value = "/api/service.csv")
    fun service(@RequestParam("name") name: String): ResponseEntity<String> {
        val responseHeaders = HttpHeaders()
        responseHeaders.add("Content-Type", "application/csv; charset=utf-8")
        responseHeaders.add("Content-Disposition", "attachment;filename=file.csv")
        val data: String = generateCSVFor(name)
        return ResponseEntity(data, responseHeaders, HttpStatus.OK)
    }