logo

Improper Neutralization of Formula Elements in a CSV File

Incomplete Base
Structure: Simple
Description

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

Extended Description

User-provided data is often saved to traditional databases. This data can be exported to a CSV file, which allows users to read the data using spreadsheet software such as Excel, Numbers, or Calc. This software interprets entries beginning with '=' as formulas, which are then executed by the spreadsheet software. The software's formula language often allows methods to access hyperlinks or the local command line, and frequently allows enough characters to invoke an entire script. Attackers can populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software.
Common Consequences 1
Scope: Confidentiality

Impact: Read Application DataExecute Unauthorized Code or Commands

Current versions of Excel warn users of untrusted content.
Potential Mitigations 3
Phase: Implementation
When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).

Effectiveness: Moderate

Phase: Implementation
If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.

Effectiveness: Moderate

Phase: Architecture and Design
Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.

Effectiveness: Limited
Demonstrative Examples 1
Hyperlinks or other commands can be executed when a cell begins with the formula identifier, '='

Code Example:

Attack
Other

=HYPERLINK(link_location, [friendly_name])

Stripping the leading equals sign, or simply not executing formulas from untrusted sources, impedes malicious activity.

Code Example:

Good
Other

HYPERLINK(link_location, [friendly_name])
Observed Examples 3
CVE-2019-12134Low privileged user can trigger CSV injection through a contact form field value
CVE-2019-4521Cloud management product allows arbitrary command execution via CSV injection
CVE-2019-17661CSV injection in content management system via formula code in a first or last name
References 4
CSV Injection
OWASP
02-02-2020
https://owasp.org/www-community/attacks/CSV_Injection
ID: REF-21
Data Extraction to Command Execution CSV Injection
Jamie Rougvie
06-09-2019
https://www.veracode.com/blog/secure-development/data-extraction-command-execution-csv-injection
ID: REF-22
The Absurdly Underestimated Dangers of CSV Injection
George Mauer
07-10-2017
https://georgemauer.net/2017/10/07/csv-injection.html(2025-07-25)
ID: REF-23
Comma Separated Vulnerabilities
James Kettle
29-08-2014
https://rstforums.com/forum/topic/82690-comma-separated-vulnerabilities/(2023-04-07)
ID: REF-24
Applicable Platforms
Languages:
Not Language-Specific : Undetermined
Technologies:
Other : Undetermined
Modes of Introduction
Implementation
Alternate Terms

CSV Injection

Formula Injection

Excel Macro Injection
Related Weaknesses
ChildOf: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
ChildOf: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)