4

I'm working on a web application and we have an administrative feature that allows admins to import an excel spreadsheet containing information about sub-users they would like to add. We parse the spreadsheet and do basic input validation on most fields. We also ensure that the file has the correct extension before starting doing any deeper examination of the file.

I'm just curious if there are any other risks I'm overlooking when dealing with imported user data. Specifically importing Excel Spreadsheets.

Improve this question
4
  • 1
    You can parse spreadsheets in Python, Java, JavaScript, and two scores of other languages without even touching a macro.
    – Deer Hunter
    Mar 31, 2016 at 17:44
  • Since you're presumably only extracting current cell values, I'd think the only real surface for attack would be bad values - and even then, you're more likely to hit character encoding issues.
    – Phil Lello
    Mar 31, 2016 at 18:23
  • This was along the terms of what I was thinking. I wasn't aware if there could possibly be a way of sending a file with malicious contents that was labeled with a .xlsx extension that could cause issues once imported by the webservice. @PhilLello, you're correct, we're only really extracting cell values and doing input validation on those; worst case there they fail validation and the job fails with a descriptive error.
    – beatsbears
    Mar 31, 2016 at 18:57
  • I should also highlight I'm assuming a non-office library for access... If you were launching excel and controlling it programmatically then it's all the normal macro risks.
    – Phil Lello
    Mar 31, 2016 at 19:12

3 Answers 3

Reset to default
2

While Austin is correct, it is also a risk that the file itself contains an exploit. Office applications are utterly massive and have a truly humungous attack surface area. If you have time on your hands, open up an instrumented fuzzer like American Fuzzy Lop (AFL) and run it on your Excel processor. You will find a stunning amount of very scary-looking crashes.

You have to assess your risk here. If you are defending against someone who only has the skills to write a malicious macro, you probably don't have much to worry about. If you are defending against someone who knows a thing or two about software exploitation and you are their target, you opening their spreadsheets will be a dream come true.

Improve this answer
1

I think the biggest risk I can think of is if that spreadsheet contains a malicious macro.

Macros in Office have been exploitable for a long time, and recently Locky and a few other cryptolockers have taken to infecting users by macros in Word. I see no reason why the macro wouldn't work in other Office programs.

https://medium.com/@networksecurity/locky-ransomware-virus-spreading-via-word-documents-51fcb75618d2#.eekz0ygoz

Improve this answer
1
  • The parser will not run the macro.
    – Rápli András
    Apr 1, 2016 at 6:32
0

A for instance of what to watch out for is illustrated by a patch released for Magento, SUPEE-5994 which addressed the following issue from exported, user entered content:

Attacker can provide input that executes a formula when exported and opened in a spreadsheet such as Microsoft Excel. The formula can modify data, export personal data to another site, or cause remote code execution. The spreadsheet usually displays a warning message, which the user must dismiss for the attack to succeed.

So, the usual warnings apply, arbitrary content accepted from the web without proper mitigation can bear interesting surprises when opened in a spreadsheet program for which the malicious content is tailored.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .