T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/main.py:399
- Finding
- Spreadsheet Formula Injection in Exported Clinical Data<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.py`, lines 108-117 and 399-406 **Vulnerability Type**: Untrusted spreadsheet content exported without formula neutralization **Risk Level**: Medium ### Vulnerable Code ```python def load_data(self, input_path: str) -> pd.DataFrame: """Load data from CSV or Excel file.""" path = Path(input_path) if not path.exists(): raise FileNotFoundError(f"Input file not found: {input_path}") if path.suffix.lower() == '.csv': return pd.read_csv(input_path) elif path.suffix.lower() in ['.xlsx', '.xls']: return pd.read_excel(input_path) ``` ```python # Save output output_path = Path(args.output) if output_path.suffix.lower() == '.csv': df_cleaned.to_csv(args.output, index=False) elif output_path.suffix.lower() in ['.xlsx', '.xls']: df_cleaned.to_excel(args.output, index=False) else: # Default to CSV df_cleaned.to_csv(args.output, index=False) ``` ### Technical Analysis The application accepts text fields from CSV or Excel files and writes them back to spreadsheet-compatible output without validating or neutralizing formula-prefixed values. Values beginning with characters such as `=`, `+`, `-`, or `@` may be interpreted as formulas by spreadsheet software. An attacker able to influence an input field—such as a subject identifier, study identifier, race value, test code, or another textual column—can insert a formula payload that survives the cleaning process. The Python process itself does not execute the formula. Exploitation occurs when a reviewer subsequently opens the generated CSV or Excel file in spreadsheet software with formula evaluation enabled. ### Attack Path 1. An attacker or compromised upstream data source inserts a formula-prefixed string into a textual clinical-data field. 2. The application loads the value through `pandas.read_csv()` or `pandas.read_excel()`. 3. The cleaning pipeline preserves the malicious text because ...[truncated 1220 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Before spreadsheet-compatible export, inspect every textual cell for leading formula characters such as `=`, `+`, `-`, and `@`. 2. Neutralize suspicious values using an explicit and documented policy, such as prefixing them with an apostrophe where appropriate. 3. Account for leading whitespace, tabs, carriage returns, and other characters that spreadsheet software may ignore before formula evaluation. 4. Preserve the original value in a protected audit record if regulatory traceability requires exact source-value retention. 5. Distinguish between raw archival exports and analyst-facing safe exports. 6. Add automated tests covering malicious values such as: - `=HYPERLINK(...)` - `+SUM(1,1)` - `@SUM(1,1)` - Formula strings preceded by spaces, tabs, or carriage returns 7. Warn users that output derived from untrusted inputs must not be opened with automatic formula evaluation enabled. 8. For Excel output, configure the writer to prevent string-to-formula conversion where the selected engine supports that option. ]]>