I work in an enterprise environment on small custom applications which read data files (usually CSVs) and integrate the data into accounting software systems. I have come across a situation where there is a server with a user always logged-in and always running Outlook. This instance of Outlook has some VBA which will download e-mail attachments, as long as the sender's domain matches a pre-defined value. The file is downloaded to a folder where a .NET app is waiting to pick up files for processing.
What are the security implications / risks of this scenario?
I imagine there is some benefit to security through obscurity. Yet, what if a file that was infected was sent and downloaded? If the .NET app only reads files with a .csv extension, can infected files be a CSV? Can it execute its malicious payload by being read by an app treating it like a comma-delimited file?
Thank you for your thoughts and guidance. I am new to this particular stack exchange and welcome any corrections to etiquette.