by Serguey Shinder
It went out every Monday at seven. A file of open tickets, one row each, emailed to four people in operations who used it to plan their week. It had been running for three years and I had never once thought of it as a security surface, because it was a file, and files are not code.
That Monday, one of the four opened it and got a dialog she had never seen before, warning her that the file contained something that would run and asking whether she trusted the source. She did trust the source. It was us. She clicked through, then thought about it for a minute and sent me a screenshot anyway, which is the only reason I know any of this happened.
A customer had typed something into the reference field on a ticket, and what they typed began with an equals sign. Our export wrote the field out exactly as given. The spreadsheet read a leading equals sign the way spreadsheets do, as the start of a formula, and offered to evaluate it.
In this case it was nothing. Somebody had probably pasted a fragment of a cell out of their own spreadsheet into our web form. There was no attacker. What there was, fully assembled and running weekly for three years, was a path by which a stranger on the internet could place an instruction in front of an operations manager's spreadsheet, inside a file that arrived from a colleague's address and looked completely routine.
Everything I had ever learned about untrusted input concerned the boundary between the outside world and our application. I validated it on the way in. I escaped it on the way into a page. What I had never considered was the boundary on the way out, where our application hands its data to a program I did not write, running on a laptop I do not control, which holds its own strong opinions about what certain characters mean.
The output of one system is the input to another. Ours produced a text file and I had been thinking of that file as an ending. To the spreadsheet it was a beginning.
We quote every field on the way out now and neutralise anything that opens with an equals, a plus, a minus or an at sign. The thing that mattered more was the change of question. Before I let data leave a system I ask what program is going to open this, and what does that program treat as an instruction rather than as text.
I also stopped being quietly annoyed that she clicked through the warning. She had a Monday to plan and three years of that file being harmless behind her. If the safety of a system depends on somebody reading a dialog carefully at seven in the morning, the system is not safe. It is lucky.
– Serguey Asael Shinder
Leave a Reply