T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/generate_assessment_period_report.py:466
- Finding
- Untrusted Spreadsheet Values Are Exported Without Formula Neutralization## Vulnerability Details **File Location**: `scripts/generate_assessment_period_report.py`, lines 466-472 **Vulnerability Type**: Spreadsheet formula injection **Risk Level**: Medium ```python for i, (_, row) in enumerate(all_data.iterrows(), start=2): for j, col in enumerate(all_columns, start=1): value = row[col] # Handle NaN values if pd.isna(value): value = '' ws_raw.cell(row=i, column=j, value=value) ``` ### Technical Analysis The report generator copies values from the input workbook directly into cells in the output workbook. It does not inspect or neutralize strings that begin with spreadsheet formula prefixes such as `=`, `+`, `-`, or `@`. Consequently, an attacker who can influence the source workbook may insert formula-like content into any field exported to the raw-data worksheet. When the generated workbook is opened in formula-capable spreadsheet software, that content may be interpreted as a formula rather than as literal text. The exact behavior depends on the spreadsheet application and its security configuration. Potential payloads include deceptive formulas, external links, or functions that attempt to transmit workbook or environment data to an attacker-controlled destination. ### Attack Path 1. An attacker gains the ability to add or modify a value in the source Excel workbook. 2. The attacker inserts a formula-prefixed value into a field that will be copied to the raw-data worksheet. 3. The report generator reads the malicious value through pandas. 4. The value is passed unchanged to `ws_raw.cell(..., value=value)`. 5. The generated report is delivered to or opened by an authorized user. 6. The spreadsheet application interprets the value as a formula. 7. Depending on application policy and user interaction, the formula may display deceptive content, access other workbook cells, or initiate an external request. ### Impact Assessment ...[truncated 584 chars]
- Remediation
- ## Remediation Suggestions Treat every value originating from an input workbook as untrusted before writing it to the output workbook. 1. Detect strings beginning with formula-significant characters, including `=`, `+`, `-`, `@`, tab, carriage return, and line feed. 2. Store such values explicitly as text or prefix them with an apostrophe before writing them. 3. Apply the protection to every worksheet that contains source-controlled values, not only the raw-data worksheet. 4. Consider using a strict allowlist for fields that are expected to be numeric or datetime values. 5. Add regression tests containing representative payloads such as formula prefixes, leading whitespace followed by a formula, and external-link formulas. 6. Document that reports should be opened with external content and macros disabled. Example hardening logic: ```python def neutralize_spreadsheet_formula(value): if isinstance(value, str): normalized = value.lstrip() if normalized.startswith(('=', '+', '-', '@', '\t', '\r', '\n')): return "'" + value return value value = neutralize_spreadsheet_formula(value) ws_raw.cell(row=i, column=j, value=value) ```