2021
When generating CSV output, ensure that formula-sensitive metacharacters are effectively
escaped or removed from all data before storage in the resultant CSV. Risky characters include
'=' (equal), '+' (plus), '-' (minus), and '@' (at).
Effectiveness = Moderate
Unfortunately, there is no perfect solution, since different spreadsheet products act differently.
Phase: Implementation
If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents
Excel from executing the formula.
Effectiveness = Moderate
It is not clear how effective this mitigation is with other spreadsheet software.
Phase: Architecture and Design
Certain implementations of spreadsheet software might disallow formulas from executing if the
file is untrusted, or if the file is not authored by the current user.
Effectiveness = Limited
This mitigation has limited effectiveness because it often depends on end users opening
spreadsheet software safely.
Demonstrative Examples
Example 1:
Hyperlinks or other commands can be executed when a cell begins with the formula identifier, '='
Example Language: Other (Attack)
=HYPERLINK(link_location, [friendly_name])
Stripping the leading equals sign, or simply not executing formulas from untrusted sources,
impedes malicious activity.
Example Language: (Good)
HYPERLINK(link_location, [friendly_name])
Observed Examples
Reference Description
CVE-2019-12134 Low privileged user can trigger CSV injection through a contact form field value
https://www.cve.org/CVERecord?id=CVE-2019-12134
CVE-2019-4521 Cloud management product allows arbitrary command execution via CSV
injection
https://www.cve.org/CVERecord?id=CVE-2019-4521
CVE-2019-17661 CSV injection in content management system via formula code in a first or last
name
https://www.cve.org/CVERecord?id=CVE-2019-17661
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-1239: Improper Zeroization of Hardware Register
CWE-1239: Improper Zeroization of Hardware Register