T09 · Insecure Skill Coding Practices
- Location
scripts/yotta_intel.py:337- Finding
CSV Formula Injection Through Attacker-Controlled IOC Context
- Content
View full analysis
Vulnerability Details
File Location:
scripts/yotta_intel.py, lines 337–345, 359–365, and 464–465
Vulnerability Type: CSV formula injection
Risk Level: MediumVulnerable code:
python if entry is None: snippet = "" if 0 < idx <= len(orig_lines): snippet = orig_lines[idx - 1].strip() entry = { "type": ioc_type, "value": canonical, "defanged": defang_value(canonical, ioc_type), "count": 0, "first_line": idx, "snippet": snippet, }python def build_csv(records): out = io.StringIO() w = csv.writer(out) w.writerow(["type", "value", "defanged", "count", "first_line", "snippet"]) for r in records: w.writerow([r["type"], r["value"], r["defanged"], r["count"], r["first_line"], r["snippet"]]) return out.getvalue()python elif args.format == "csv": out = build_csv(records)Technical Analysis
The Skill is explicitly designed to process potentially hostile threat reports, phishing emails, and logs. When an IOC is found, the complete original source line is retained in the
snippetfield. That attacker-controlled field is then passed directly tocsv.writerwithout neutralizing spreadsheet formula prefixes.CSV quoting only preserves field structure; it does not reliably prevent spreadsheet applications from interpreting cells beginning with characters such as
=,+,-, or@as formulas. Consequently, a source line such as=ATTACKER_FORMULA ... evil.example.comcan remain a formula-bearing cell in the generated CSV.Attack Path
- An external party supplies a phishing email, threat report, or log line containing both a valid IOC and spreadsheet formula syntax at the beginning of the line.
- An analyst or automated workflow processes that content with:
bash python3 scripts/yotta_intel.py extract --path report.txt --fo
...[truncated 1044 chars]
- Remediation
View remediation
Remediation Suggestions
Neutralize every attacker-derived textual field before writing spreadsheet-oriented CSV output, especially
snippet.- Detect cells whose first meaningful character is
=,+,-, or@. Also account for leading tabs, carriage returns, newlines, and other whitespace that spreadsheet applications may ignore. - Prefix dangerous cells with an apostrophe or use another escaping policy documented for the supported spreadsheet applications.
- Apply the protection through a centralized helper to every string written to CSV rather than only to
snippet. - Preserve a machine-oriented JSON output option for consumers that require the original unmodified text.
- Add tests covering direct and whitespace-prefixed formulas, including quoted fields and formulas embedded on lines containing valid IOCs.
- Document that CSV output is spreadsheet-safe only after formula neutralization and clarify any escaping transformations applied to source context.
- Detect cells whose first meaningful character is