目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-1236 类漏洞列表 153

CWE-1236 类弱点 153 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1236 属于 CSV 注入漏洞，指程序将用户输入写入 CSV 文件时未对特殊字符进行适当转义。攻击者利用此缺陷，在数据中嵌入以等号、加号或制表符开头的恶意公式，当受害者使用电子表格软件打开文件时，这些公式会被自动执行，可能导致数据泄露、远程代码执行或系统配置篡改。开发者应通过转义特殊字符、限制输入内容或采用非公式格式存储数据来防御此类攻击。

MITRE CWE 官方描述
CWE：CWE-1236 CSV 文件中公式元素的不当中和 英文：产品将用户提供的信息保存到逗号分隔值（Comma-Separated Value, CSV）文件中，但未对特殊元素进行中和，或中和不当，导致当文件被电子表格产品打开时，这些元素可能被解释为命令。
常见影响 (1)
Confidentiality Read Application Data, Execute Unauthorized Code or Commands
Attackers can populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software. Note that current versions of Excel warn users of untrusted content.
缓解措施 (3)
Implementation When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
Effectiveness: Moderate
Implementation If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
Effectiveness: Moderate
Architecture and Design Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.
Effectiveness: Limited
代码示例 (1)
Hyperlinks or other commands can be executed when a cell begins with the formula identifier, '='
=HYPERLINK(link_location, [friendly_name])
Attack · Other
HYPERLINK(link_location, [friendly_name])
Good · Other
CVE ID 标题 CVSS 风险等级 Published
CVE-2021-1474 Cisco Umbrella 注入漏洞 — Cisco Umbrella Insights Virtual Appliance 6.5 Medium 2021-04-08
CVE-2020-25170 B. Braun Melsungen AG onlinesuite 安全漏洞 — OnlineSuite 7.8 - 2020-11-06
CVE-2020-16214 Patient Information 安全漏洞 — Patient Information Center iX (PICiX) 8.7 - 2020-09-11

CWE-1236 是常见的弱点类别，本平台收录该类弱点关联的 153 条 CVE 漏洞。