Data Export

Treat Spreadsheet Exports as Active Content

A CSV export can look harmless because the application is only writing text. The risk appears later, when a spreadsheet program opens that text and decides that a cell is a formula rather than ordinary data. If an attacker can control a field that appears in an export, a value intended to be a name, note, ticket title, or other text may be interpreted by the spreadsheet application as active spreadsheet content. The consequence depends on the spreadsheet software and its configuration, but it can include misleading calculated values, unexpected links or external interactions, and other behavior the exporting application never intended to authorize.