Comma Separated Vulnerabilities: Detecting Formula Injection in the Wild
summary
Claims that CSV files enable remote data exfiltration and even code execution by embedding spreadsheet formulas, and backs it with a tool and measurements. Builds CSVScan (static taint analysis for Java) and inspects 156 GitHub projects yielding 107 apps, 66 built, 45 analyzable; finds 8 end-to-end flows and four vulnerable apps where low-privileged users can attack higher-privileged ones. Tests eight spreadsheet products (most support concat ranges and web/image formulas; Excel offline has a command formula) and finds four CSV libraries with no protections.
AI-written summary · about
chapters (6)
- 0:00CSV vulnerabilities intro
- 2:40Spreadsheets execute formulas
- 4:24CSV formula injection attack
- 7:15Testing spreadsheets for flaws
- 10:46Automated formula injection detection
- 13:59Mitigation and findings
related talks
58mVulnerability Data Analysis with Google Spreadsheets and Apps Script for Fun and Profit
55mBreaking and Fixing Web Application Security
48mCommon vulnerabilities you wish your Java app didn't have!
49mOpen-source vulnerability management? Use the source, Luke!
56mThe Anatomy of Java Vulnerabilities
36mExploiting Vulnerabilities and Flaws to Attack Supply Chain
37mStranger Danger: Finding Security Vulnerabilities Before They Find You!
48mThe Hidden Security Hazards in Your Java Stack