xslx formula injection

There is a formula injection bug in pytablewriter:

from pytablewriter import ExcelXlsxTableWriter, JsonTableWriter, HtmlTableWriter, ExcelXlsTableWriter

VALUES = [
    # These ones are OK:
    (HtmlTableWriter, "html"),
    (JsonTableWriter, "json"),
    (ExcelXlsTableWriter, "xls"),
    # Injection on this class:
    (ExcelXlsxTableWriter, "xlsx"),
]

for (Writer, extension) in VALUES:
    writer = Writer()
    writer.table_name = "test"
    writer.headers = ["x"]
    writer.value_matrix = [["=cmd|' /C notepad'!'A1'"]]
    writer.dump("test." + extension)

Note how the content of test.xslx is different of the content of the other generated files (including test.xsl): the input is expanded into a formula instead of being treated a plain text.

This is a security issue: it can be abused to trigger shell command injection or data exfiltration from Excel/LibreOffice. See [1,2,3] for examples of data exfiltration and shell command execution. The examples are in the context of CSV injection but the same payloads can be used here.

[1] https://www.notsosecure.com/data-exfiltration-formula-injection/ [2] http://georgemauer.net/2017/10/07/csv-injection.html [3] https://youtu.be/C1o5uVOaufU?t=364

[thombashi]

I had added an interface to escape formula injection at pytablewriter 0.47.0

[randomstuff]

For CSV files, it’s not clear to me what should be done about it. In this case, it’s really more a problem of a consumer that a problem of a producer in my opinion. There is no notion of formula in CSV. All we can so is to use hackish workarounds which could break some input data. I’d think that using .xslx instead of CSV as output might be a way to avoid the problem of injection when targeting spreadsheets programs which might be vulnerable to this sort of things.

For .xls files, I don’t know if it is possible to do something similar to what I’m proposing.