Fallos del tipo CWE-1236

204 resultados

Falta de neutralização de fórmulas em arquivos CSV

Quando um arquivo CSV contém fórmulas (como =cmd|'/c calc'!A1 ou =1+1), aplicativos que abrem o arquivo automaticamente as interpretam e executam, permitindo injeção de código. O risco é alto porque o usuário apenas abre um arquivo aparentemente inofensivo e o aplicativo (Excel, Calc, etc.) executa comandos maliciosos sem aviso adequado.

Ejemplo

Um relatório exportado em CSV com dados de usuários contém um campo começando com '=' que, quando aberto no Excel, executa uma macro ou comando do sistema. Um atacante injeta a fórmula no banco de dados ou upload de arquivo, e qualquer pessoa que baixe e abra o CSV sofre o ataque.

Cómo mitigar

Prefixe campos suspeitos com um caractere neutro (como aspas simples ou espaço) antes de gerar o CSV, ou configure o aplicativo para não interpretar fórmulas automaticamente. Na aplicação, valide e escape qualquer conteúdo que inicie com caracteres de fórmula (=, +, -, @, tabulação).

CVE-2023-45597MEDIUMA CWE-1236 “Improper Neutralization of Formula Elements in a CSV File” vulnerability in the “file_configuration” functionality of the web apEPSS 0.4%CVE-2024-25007HIGHEricsson Network Manager - Improper Neutralization of Formula Elements VulnerabilityEPSS 0.4%CVE-2023-25348HIGHChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new peEPSS 0.4%CVE-2024-27785MEDIUMAn improper neutralization of formula elements in a CSV File [CWE-1236] vulnerability in Fortinet FortiAIOps 2.0.0 may allow a remote authenEPSS 0.4%CVE-2026-55452MEDIUMSnipe-IT: CSV formula injection in Activity Report exportEPSS 0.4%CVE-2026-14846MEDIUMIncorrect neutralisation in the PrestaShop firmwareEPSS 0.4%CVE-2021-23286MEDIUMSecurity issues in Eaton Intelligent Power Manager InfrastructureEPSS 0.4%CVE-2024-9102MEDIUMphpLDAPadmin: Improper Neutralization of Formula ElementsEPSS 0.4%CVE-2024-45084HIGHIBM Cognos Controller CSV injectionEPSS 0.4%CVE-2026-78209HIGHexceljs through 4.4.0 CSV Formula Injection via Unescaped Cell ValuesEPSS 0.4%CVE-2026-86742MEDIUMSnipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance ReportEPSS 0.4%CVE-2025-60852MEDIUMA CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600. Applications built with affected versionsEPSS 0.4%CVE-2023-51298MEDIUMPHPJabbers Event Booking Calendar v4.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulEPSS 0.4%CVE-2023-2629MEDIUMImproper Neutralization of Formula Elements in a CSV File in pimcore/customer-data-frameworkEPSS 0.4%CVE-2025-62417HIGHbagisto - CSV Formula Injection in Create New ProductEPSS 0.4%CVE-2023-43071MEDIUM Dell SmartFabric Storage Software v1.4 (and earlier) contains possible vulnerabilities for HTML injection or CVS formula injection which miEPSS 0.4%CVE-2023-46400MEDIUMKWHotel 0.47 is vulnerable to CSV Formula Injection in the add guest function.EPSS 0.4%CVE-2026-47693MEDIUMPoweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applicationsEPSS 0.4%CVE-2026-39424MEDIUMMaxKB has CSV Injection in its Application Chat Export FunctionalityEPSS 0.4%CVE-2026-64955MEDIUMVelociraptor CSV Formula Injection in Export PipelineEPSS 0.4%