CVE-2021-41270: Prevent CSV Injection via formulas

Description

CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program opens a CSV, any cell starting with = is interpreted by the software as a formula and could be abused by an attacker.

In Symfony 4.1, we've added the opt-in csv_escape_formulas option in CsvEncoder, to prefix all cells starting by =, +, - or @ by a tab \t.

Since then, OWASP added 2 chars in that list:

  • Tab (0x09)
  • Carriage return (0x0D)

This makes our previous prefix char (Tab \t) part of the vulnerable characters, and OWASP suggests using the single quote ' for prefixing the value.

Resolution

Symfony now follows the OWASP recommendations and use the single quote ' to prefix formulas and adds the prefix to cells starting by \t, \r as well as =, +, - and @.

The patch for this issue is available here for branch 4.4.

Credits

We would like to thank Jake Barwell for reporting the issue and Jérémy Derussé for fixing the issue.

                Sponsor the Symfony project.

https://symfony.com/blog/cve-2021-41270-prevent-csv-injection-via-formulas?utm_source=Symfony%20Blog%20Feed&utm_medium=feed

Creată 4y | 24 nov. 2021, 09:20:09


Autentifică-te pentru a adăuga comentarii

Alte posturi din acest grup

A Week of Symfony #967 (July 7–13, 2025)

This week, Symfony unveiled the Symfony AI initiative, a set of components and bundles designed to bring powerful AI capabilities directly into your PHP applications. In addition, we published travel

13 iul. 2025, 09:20:11 | Symfony
Kicking off the Symfony AI Initiative

Today we are happy to announce a new Symfony initiative called Symfony AI - with the goal to provide a comprehensive set of components and bundles designed to bring powerful AI capabilities directly i

11 iul. 2025, 13:20:27 | Symfony
SymfonyCon Amsterdam 2025: Travel & Lodging Tips

SymfonyCon Amsterdam 2025, our next annual international Symfony conference, will take place on:

November 25 & 26: 2 workshops days with several topics to learn, practice and improve your skills

11 iul. 2025, 08:40:20 | Symfony
A Week of Symfony #966 (June 30 – July 6, 2025)

This week, development on the upcoming Symfony 8.0 version continued with the removal of deprecated features and the marking of several classes as final. In addition, we published two new case studies

6 iul. 2025, 08:10:15 | Symfony
Case study: Modernizing Audi France’s Digital Ecosystem with Symfony 6

At Wide, Micropole’s digital agency, they help leading brands modernize their digital infrastructures while ensuring scalability, security, and performance. When Audi France approached them to migrate

4 iul. 2025, 09:40:14 | Symfony
Case study: A Long-Term Powerhouse Behind Vente-unique.com's E-Commerce Success (Zero Churn, All Wins!)

Vente-unique.com, a leading European online retailer of furniture and home decor, operates in 11 countries, powered by a team of 400 professionals and serving more than 3 million customers. From 15 ye

2 iul. 2025, 09:10:03 | Symfony
A Week of Symfony #965 (June 23–29, 2025)

This week, Symfony 6.4.23, 7.2.8 and 7.3.1 maintenance versions were released. Meanwhile, the upcoming Symfony 7.4 version continued adding new features such as better controller helpers, more precisi

29 iun. 2025, 09:10:15 | Symfony