If anyone knows any I'd be very interested
Are there any csv exploits? |
 (Feb 26, 2019 09:48 AM)valetta Wrote: I think there is a macro vulnerability recently, not sure though since I didn't look into it too much. Pretty sure you can't use macros on csv files. (Feb 26, 2019 10:11 AM)GREEDYZ Wrote: Pretty sure you can't use macros on csv files. Oh, maybe the exploit is for xls then for the one I saw. There's a CSV command injection vuln if client is using 2013 I think or something like that. 
Feb 26, 2019 12:50 PM
(This post was last modified: Feb 26, 2019 12:50 PM by Faith Connors.)
csv is just a standard for formatting data, so theres no inherent way it can be "exploited," the same sense on how html cant be inherently exploited.
that being said, there might be a way that an application parses the file unsafely (not checking out of bounds data like a maximum string or int length). so id suggest starting there, if you have an application in mind.
humble rubyist in a world of pythonistas
There is some weaponization that has been on on CSV files .. I'll have to find it.
http://georgemauer.net/2017/10/07/csv-injection.html |
|
|
