CWE-1236 Base Incompleto

Improper Neutralization of Formula Elements in a CSV File

This vulnerability occurs when an application writes user-supplied data into a CSV file without properly sanitizing special characters. Spreadsheet programs like Excel or Google Sheets interpret…

Definição

What is CWE-1236?

This vulnerability occurs when an application writes user-supplied data into a CSV file without properly sanitizing special characters. Spreadsheet programs like Excel or Google Sheets interpret entries starting with '=' as executable formulas, which can lead to malicious command execution when the file is opened.
Many applications export data to CSV files for easy viewing in spreadsheet software. However, these programs treat cells beginning with characters like =, +, -, or @ as formulas. If an attacker can inject data like `=HYPERLINK("http://malicious-site.com", "Click")` or a formula that calls external scripts, simply opening the CSV file can trigger data theft, remote code execution, or other harmful actions on the user's machine. Developers often overlook this risk because CSV files are seen as simple data dumps, not executable content. To prevent this, you must sanitize or escape formula-initiating characters in all user-controlled fields before writing them to a CSV. This ensures that data is displayed as static text, not as an active command, when the file is imported into a spreadsheet application.
Impacto no mundo real

Real-world CVEs caused by CWE-1236

  • CVE-2019-12134

    Low privileged user can trigger CSV injection through a contact form field value

  • CVE-2019-4521

    Cloud management product allows arbitrary command execution via CSV injection

  • CVE-2019-17661

    CSV injection in content management system via formula code in a first or last name

Como os atacantes a exploram

Trajeto do atacante passo a passo

  1. 1

    Identificar um caminho de código que trata input não confiável sem validação.

  2. 2

    Criar um payload que explora o comportamento inseguro — injeção, traversal, overflow ou abuso de lógica.

  3. 3

    Entregar o payload através de um pedido normal e observar a reação da aplicação.

  4. 4

    Iterar até que a resposta exponha dados, execute código do atacante ou escale privilégios.

Exemplo de código vulnerável

Vulnerable Other

Hyperlinks or other commands can be executed when a cell begins with the formula identifier, '='

Vulnerável Other 
=HYPERLINK(link_location, [friendly_name])
Payload do atacante

Hyperlinks or other commands can be executed when a cell begins with the formula identifier, '='

Payload do atacante Other 
=HYPERLINK(link_location, [friendly_name])
Exemplo de código seguro

Secure Other

Stripping the leading equals sign, or simply not executing formulas from untrusted sources, impedes malicious activity.

Seguro Other 
HYPERLINK(link_location, [friendly_name])
What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Lista de verificação de prevenção

How to prevent CWE-1236

  • Implementation When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
  • Implementation If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
  • Architecture and Design Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.
Sinais de deteção

How to detect CWE-1236

SAST High

Executar análise estática (SAST) na base de código à procura do padrão inseguro no fluxo de dados.

DAST Moderate

Executar testes dinâmicos de segurança de aplicações (DAST) contra o endpoint em execução.

Runtime Moderate

Monitorizar os registos em tempo de execução para traços de exceção invulgares, input malformado ou tentativas de contornar a autorização.

Code review Moderate

Revisão de código: sinalizar qualquer novo código que trate input desta superfície sem usar os ajudantes validados do framework.

Correção automática do Plexicus

O Plexicus deteta automaticamente o CWE-1236 e abre um PR de correção em menos de 60 segundos.

O Codex Remedium analisa cada commit, identifica esta fraqueza exata e entrega um pull request pronto para revisão com o patch. Sem tickets. Sem transferências.

Obter uma demonstração Experimente o Plexicus gratuitamente
Perguntas frequentes

Frequently asked questions

O que é o CWE-1236?

This vulnerability occurs when an application writes user-supplied data into a CSV file without properly sanitizing special characters. Spreadsheet programs like Excel or Google Sheets interpret entries starting with '=' as executable formulas, which can lead to malicious command execution when the file is opened.

Qual a gravidade do CWE-1236?

A MITRE não publicou uma classificação de probabilidade de exploração para esta fraqueza. Trate-a como impacto médio até o seu modelo de ameaças provar o contrário.

Que linguagens ou plataformas são afetadas pelo CWE-1236?

MITRE lists the following affected platforms: Not OS-Specific, Not Architecture-Specific, Other.

Como posso prevenir o CWE-1236?

When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at). If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.

Como é que o Plexicus deteta e corrige o CWE-1236?

O motor SAST do Plexicus correlaciona a assinatura de fluxo de dados do CWE-1236 em cada commit. Quando é encontrada uma correspondência, o nosso agente Codex Remedium abre um PR de correção com o código corrigido, testes e um resumo de uma linha para o revisor.

Onde posso saber mais sobre o CWE-1236?

A MITRE publica a definição canónica em https://cwe.mitre.org/data/definitions/1236.html. Pode também consultar a documentação da OWASP e do NIST para orientações adjacentes.

Fraquezas relacionadas

Weaknesses related to CWE-1236

CWE-74 Pai

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

This vulnerability occurs when an application uses untrusted external input to build a command, query, or data structure for another…

CWE-75 Irmão

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

This vulnerability occurs when an application fails to properly filter or encode user-supplied data containing special characters or…

CWE-77 Irmão

Improper Neutralization of Special Elements used in a Command ('Command Injection')

This vulnerability occurs when an application builds a system command using untrusted user input without properly sanitizing it. An…

CWE-78 Irmão

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

OS Command Injection occurs when an application builds a system command using untrusted, external input without properly sanitizing it.…

CWE-79 Irmão

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

This vulnerability occurs when a web application fails to properly sanitize or encode user-supplied input before displaying it on a…

CWE-88 Irmão

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

This vulnerability occurs when an application builds a command string for execution by another component, but fails to properly separate…

CWE-89 Irmão

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

SQL Injection occurs when an application builds a database query using untrusted user input without properly sanitizing it. This allows an…

CWE-91 Irmão

XML Injection (aka Blind XPath Injection)

XML Injection occurs when an application fails to properly validate or escape user-controlled input before including it in XML documents…

CWE-917 Irmão

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Expression Language Injection occurs when an application uses untrusted, external input to build an expression language statement—common…

Recursos

Further reading

Pronto quando você estiver

Pare de pagar por desenvolvedor.
Comece a fechar o ciclo.

O Plexicus é o ASPM nativo de IA que verifica, filtra, corrige, pentesta e explica — de forma autónoma. Programadores ilimitados, repos ilimitados, ações de IA de utilização justa. Nível gratuito real, €269/mo anual quando estiver pronto.

Começar grátis Reservar uma demo