T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:78- Finding
CSV Formula Injection in Exported Data
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh, lines 78–86
Vulnerability Type: CSV formula injection and improper CSV escaping
Risk Level: MediumVulnerable Code
bash csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out" done < "$f" done ;;Technical Analysis
The
valvariable contains user-controlled content read from local log files. It is written directly to a CSV file without CSV field quoting, escaping, or spreadsheet-formula neutralization.If a stored value begins with a spreadsheet formula prefix such as
=,+,-, or@, spreadsheet applications may interpret it as a formula whenexport.csvis opened. Embedded commas, double quotes, carriage returns, or newlines can also corrupt the CSV structure and permit field or row manipulation.The shell does not execute the value; exploitation occurs in downstream spreadsheet software that interprets the generated file.
Attack Path
- An attacker persuades a user or automated workflow to store attacker-controlled content through a content command, for example:
bash trend draft '=HYPERLINK("https://attacker.invalid","Open report")' - The application stores the value in a command log under
~/.local/share/trend/. - The user runs:
bash trend export csv - The exporter copies the value verbatim into
~/.local/share/trend/export.csv. - The user opens the CSV in spreadsheet software.
- If that software evaluates CSV fields as formulas, the injected expression may be activated or presented as an actionable formula.
Impact Assessment
This vulnerability does not directly grant shell privileges or execute commands within the audited script. Its scope is the account and spreadsheet environment of a user who opens the generated ...[truncated 618 chars]
- An attacker persuades a user or automated workflow to store attacker-controlled content through a content command, for example:
- Remediation
View remediation
Remediation Suggestions
- Generate CSV through a dedicated serializer rather than string concatenation.
- Enclose every field in double quotes and replace each embedded double quote with two double quotes.
- Correctly preserve embedded commas, carriage returns, and newlines.
- Before serialization, neutralize values whose first non-whitespace character is
=,+,-, or@. A common defensive option is to prefix such values with a single quote, subject to compatibility requirements. - Apply the same escaping rules to every field, including
name,ts, andval. - Add tests covering formula prefixes, commas, quotes, CRLF characters, and multiline values.
- Document that exported files can contain untrusted user input and should not be opened with formula execution enabled.
A safe implementation should use a trusted CSV-capable utility or language library. If Bash must be retained, implement and consistently apply a function that performs standards-compliant field quoting and formula neutralization.