T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:399- Finding
Spreadsheet Formula Injection in Exported Clinical Data
- Content
View full analysis
pd.DataFrame: """Load data from CSV or Excel file.""" path = Path(input_path) if not path.exists(): raise FileNotFoundError(f"Input file not found: {input_path}") if path.suffix.lower() == '.csv': return pd.read_csv(input_path) elif path.suffix.lower() in ['.xlsx', '.xls']: return pd.read_excel(input_path) ``` ```python # Save output output_path = Path(args.output) if output_path.suffix.lower() == '.csv': df_cleaned.to_csv(args.output, index=False) elif output_path.suffix.lower() in ['.xlsx', '.xls']: df_cleaned.to_excel(args.output, index=False) else: # Default to CSV df_cleaned.to_csv(args.output, index=False) ``` ### Technical Analysis The application accepts text fields from CSV or Excel files and writes them back to spreadsheet-compatible output without validating or neutralizing formula-prefixed values. Values beginning with characters such as `=`, `+`, `-`, or `@` may be interpreted as formulas by spreadsheet software. An attacker able to influence an input field—such as a subject identifier, study identifier, race value, test code, or another textual column—can insert a formula payload that survives the cleaning process. The Python process itself does not execute the formula. Exploitation occurs when a reviewer subsequently opens the generated CSV or Excel file in spreadsheet software with formula evaluation enabled. ### Attack Path 1. An attacker or compromised upstream data source inserts a formula-prefixed string into a textual clinical-data field. 2. The application loads the value through `pandas.read_csv()` or `pandas.read_excel()`. 3. The cleaning pipeline preserves the malicious text because ...[truncated 1220 chars]- Remediation
View remediation