Your Export Turned a Customer's Name Into a Formula

The admin screen
had a button.

Export to CSV.

Finance used it every Monday
and opened the file
in a spreadsheet.

One Monday
a cell in the name column
did not show a name.

It showed a link
that said click for details.

A customer had signed up
with a name that began
with an equals sign.

Your app stored it.

Your page displayed it safely,
as text.

Your export wrote it into the file
exactly as it was.

And the spreadsheet did
what spreadsheets do
with a cell that starts with equals.

It ran it.

This is formula injection,
sometimes called CSV injection.

The file format has no idea
what a formula is.

The program that opens it does.

A cell beginning with
equals,
plus,
minus,
or the at sign
can be read as a formula.

That formula can build a link
out of other cells on the sheet,
so the click sends
the neighbouring rows
to someone else's server.

Older desktop setups
could be talked into
running commands.

Most now show a warning first,
and the person in finance
clicks yes,
because the file came from your own system.

That is the real attack.

Your system lends the payload
its good name.

The fix is at the moment of export,
not at signup.

Names with an equals sign
can be real.

Your job is to make sure
they arrive as text.

For text columns,
if a value starts with
equals, plus, minus, at,
a tab
or a carriage return,
put a single quote in front of it.

The spreadsheet then shows it
as written,
and runs nothing.

Leave real number columns alone,
or every refund
becomes a string.

Quote every field.

Then test it the honest way.

Sign up as
equals one plus one.

Export.

Open the file in the program
finance uses.

If you see a two,
you have found it
before somebody else did.

Data that is safe on your page
is not safe everywhere it goes.

Every place it lands
has its own idea
of what text means.

– Serguey Asael Shinder