T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:74- Finding
CSV Formula Injection Through Unescaped Log Entries
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh, lines 74-79
Vulnerability Type: CSV formula injection
Risk Level: MediumVulnerable Code
bash csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" done ;;User-controlled command arguments are stored verbatim in command-specific log files by the repeated command handlers at lines 129-297. The CSV export routine then writes those values directly into CSV cells without quoting fields, escaping embedded quotes or delimiters, or neutralizing formula-leading characters.
Spreadsheet applications may interpret cells beginning with
=,+,-, or@as formulas. This creates a formula-injection boundary when an exported file is opened in spreadsheet software.Attack Path
-
An attacker persuades a user or automated process to record a malicious entry, for example:
bash microservice-gen report '=HYPERLINK("https://attacker.example/collect","Open report")' -
The command stores the supplied string unchanged in
report.log. -
The user exports the accumulated data:
bash microservice-gen export csv -
The exporter inserts the attacker-controlled value directly into
~/.local/share/microservice-gen/export.csv. -
The user opens the CSV file in spreadsheet software.
-
Depending on the spreadsheet application and its security policy, the value may be evaluated as a formula.
Impact Assessment
Exploitation does not directly grant shell or elevated operating-system privileges through this script. Its scope is the spreadsheet context of the user who opens the export. Potential consequences include deceptive links or displayed values, external network requests, disclosure of spreadsheet-accessi ...[truncated 264 chars]
-
- Remediation
View remediation
Remediation Suggestions
- Generate CSV through a standards-compliant CSV encoder rather than string concatenation.
- Enclose every field in double quotes and replace each embedded double quote with two double quotes.
- Before serialization, neutralize cells whose first non-whitespace character is
=,+,-, or@, such as by prefixing a single quote where compatible with the intended spreadsheet workflow. - Correctly preserve embedded commas, line breaks, carriage returns, and quotes.
- Consider exporting JSON as the preferred machine-readable format and warn users that CSV files may contain untrusted data.
- Add regression tests covering formula prefixes, commas, quotes, pipes, and multiline values.