T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/csv_to_excel.py:36- Finding
CSV Formula Injection in Generated Excel Workbooks
- Content
View full analysis
31: sheet_name = sheet_name[:31] df.to_excel(out, sheet_name=sheet_name, index=False, engine="openpyxl") ``` ```python with pd.ExcelWriter(out, engine="openpyxl") as writer: for path in paths: df = pd.read_csv(path, encoding=args.encoding, sep=args.sep) name = path.stem if len(name) > 31: name = name[:31] df.to_excel(writer, sheet_name=name, index=False) ``` ### Technical Analysis The script imports CSV values and writes them directly into an Excel workbook without distinguishing untrusted text from spreadsheet formulas. Values beginning with formula-significant characters such as `=`, `+`, `-`, or `@` may be interpreted as formulas when the resulting workbook is opened in Excel or another compatible spreadsheet application. An attacker who controls any CSV field can therefore place a formula payload in the generated workbook. Depending on the spreadsheet client and its security configuration, such a formula could create deceptive hyperlinks, access external resources, disclose workbook data through supported functions, or abuse legacy formula features. ### Attack Path 1. An attacker creates or modifies a CSV file processed by the Skill. 2. The attacker inserts a value such as: ```text =HYPERLINK("https://attacker.example/login","Open report") ``` 3. A user runs `csv_to_excel.py` against the attacker-controlled CSV. 4. The value is written to the output workbook without neutralization. 5. The use ...[truncated 652 chars]- Remediation
View remediation