I need to write an application that will interact with files uploaded from untrusted sources (users). Specs say I must support CSV and Excel. If I allow a user to upload an Excel file to the server and handle opening, processing and saving the file server-side, what kind of security concerns am I opening myself up to? What kind of mitigations can I bring to bear on the problem or is this fundamentally unadvisable? (For these questions, assume that web server role is running under a least privilege account.)
In particular, I am concerned about the excel file... do I have to worry about macro execution, or viruses, or it not being an excel file? I would be opening this from a C# written back-end... what risk is there attempting to read this through an excel interpreter?