[Bug]: Security Vulnerability - Potential CSV Injection attack via Export as CSV chart action

[justindm234]

Name

Justin Miller

Are you an IBM employee?

• Yes

Contact Details

[email protected]

What happened?

The "Export as CSV" action does not sanitize CSV output against potential CSV Injection attacks. For example, I was able to name my chart data groups such that Excel attempts to launch an application when opening the exported CSV (demo).

This issue raised by our PEN testers. In my product, chart group names are dynamically defined based on customer-entered values (object names). The issue is a malicous user could take an action (name an object) that would result in another user exporting malicious CSV. If that second user opened that CSV in Excel (common on many computers), the second user would be attacked. As a result, my team had to disable the "Export as CSV" option.

Malicious CSV output example (created by demo) - myChart.csv

Newer versions of Excel protect against these attacks, but older versions may not -

Version

@carbon/[email protected]

Data & options used

const lineData = [
  {
    group: "=10+20+cmd|' /C calc'!A0", // CSV Injection payload
    key: "Qty",
    value: 20000
  },
  {
    group: "=10+20+cmd|' /C calc'!A0",
    key: "More",
    value: 23500
  },
  {
    group: "=10+20+cmd|' /C calc'!A0",
    key: "Sold",
    value: 53100
  }
];

const lineChartProps = {
  data: lineData,
  options: {
    title: "Line (discrete)",
    axes: {
      bottom: {
        title: "2019 Annual Sales Figures",
        mapsTo: "key",
        scaleType: "labels"
      },
      left: {
        mapsTo: "value",
        title: "Conversion rate",
        scaleType: "linear"
      }
    },
    height: "400px"
    // toolbar: customToolbar ? toolbar(true, lineChartRef, isSessionLocal, showModal) : undefined
  }
};

Relevant log output

No response

Codesandbox example

https://codesandbox.io/s/carbon-charts-csv-injection-djcnye?file=/src/index.js

What priority level would this be in your opinion?

P0

[justindm234]

Any updates on this issue? I'm surprised this isn't being handled like a PSIRT.