Hot answers tagged

8

Yes, there are some examples of malicious CSV files causing random "code" execution. People choose to open CSV files in MS Excel or Open Office or such software which have macro execution capabilities. Some examples: https://www.contextis.com//resources/blog/comma-separated-vulnerabilities/ https://hackerone.com/reports/72785 If your environment does not ...


2

I don't think that stripping some characters can be a strong solution, especially if you develop the functionality by yourself: someone could manage to bypass this check by encoding these characters for examples, and get the formula executed anyway (Maybe your CSV reader, i.e. Excel, parse the formula differently than you and execute it anyway). Best ...


2

Yes, it may contain arbitrary system commands that will be executed on the machine where you are opening the CSV file. Your spreadsheet software will render the CSV values as the injected commands and execute after giving you multiple warnings. Example - Create a CSV file with the following 2 lines - User name,Email,Designation =2+5+cmd|' /C calc'!A0,a@b....


2

ClamAV has, as far as I know, no specific detection features for CSV files. CSV injection is not a vulnerability that an AV would resolve directly. Instead, an AV may detect known malicious macro payloads that were injected into a file, regardless of the file type. If you want to know about specific detection features, I suggest talking to the ClamAV ...


1

If parsing and storing fragments in the database is the only thing you do, I can think of the following attack scenarios: Attacking the parser: An attacker could use unexpected ascii/unicode-chars or bytes and try to derail your flow of execution during the parsing process. Attacking the DBMS with file content: An attacker could store values in the csv, ...


1

A dangerous code present in a file can be ran no matter where the file resides. But if the file is non-exe/script one (like a text) then there must be something else infiltrated to be able to execute the content. Advanced attacks can store the file pretty much anywhere, run code from there and then remove the initial file. Doing that in-memory leaves a lot ...


1

XML injection is a somewhat common vulnerability (though it's becomming less so as JSON and YAML are starting to supplant XML as the language of choice for data interchange), and has historically allowed for some really nasty attacks. The reason for this is pretty simple, XML is a pain in the arse to parse correctly (it's still pretty common to find at ...


1

Excel is a very common, very popular program, and it contains a vulnerability to CSV injection attacks. To start: Excel (And other spreadsheet programs) try to be smart. If an item in a CSV file start with a +, -, @, or =, it'll interpret that item as a formula. Ok, that's not too bad. What's the most damage an attacker can do with a formula? Turns out, ...


Only top voted, non community-wiki answers of a minimum length are eligible