Formula injection in CSV exports (CSV injection)

Formula injection in CSV exports (CSV injection)

Impact

This is a formula injection issue in the files exported by PrestaShop, commonly known as CSV injection.

Spreadsheet applications treat cells beginning with certain characters as formulas rather than text. PrestaShop wrote exported values as-is, without neutralising those characters.

The person at risk is not the shop server but whoever opens the export: a merchant, an employee, an accountant, or the customer themselves for the GDPR export.

Patches

Upgrade to 9.1.5 or 8.2.8

Workarounds

The risk can be reduced without upgrading, though this relies on merchant discipline rather than on the application:

• do not open exported CSV files by double-clicking them, open your spreadsheet application first and use its text-import wizard, setting every column to "text";
• keep your spreadsheet application up to date and never accept a prompt asking to enable content or update links when opening an export;
• if you only need to read an export, open it in a plain text editor;
• correct any back-office value that looks unusual, for example an alias or a name starting with =, +, - or @ — before exporting.

References

• CWE-1236: Improper Neutralization of Formula Elements in a CSV File
• OWASP: CSV Injection
• Report a security issue: security-core@prestashop.com

_Credits: this vulnerability was responsibly reported to the PrestaShop security team by Suphawith Phusanbai (ILOVEPEPPERONI). We thank them for their report and for coordinating the disclosure with us.