Avoiding CSV injection vulnerability in SSRS

Question

I'm trying to find a way to avoid CSV injection when i export a report to CSV format is SSRS (Microsoft Reporting Services).

The "manual way" to do it is to add an apostrophe (') to each cell. That will "convert" everything to text and relieve the threat of external code being executing automatically when opening the document. But since i have many reports and i don't want to change all of them.

Is there a configuration or a setting that can help in this situation?

More about this vulnerability:
https://www.we45.com/blog/2017/02/14/csv-injection-theres-devil-in-the-detail
https://affinity-it-security.com/how-to-prevent-csv-injection/

Answer 1

Hi

You may try like this:

Please make a copy of the config file before making any change.

1.On the SSRS server, find the RSResportServer.config file.

2.Find the<Render> tag.

3.Add the attached code inside the <Render> tags.

<Extension Name="PIPE" Type="Microsoft.ReportingServices.Rendering.DataRenderer.CsvReport,Microsoft.ReportingServices.DataRendering">  
               <OverrideNames>  
                     <Name Language="en-US">CSV (Pipe delimited)</Name>  
               </OverrideNames>  
               <Configuration>  
                 <DeviceInfo>  
                     <FieldDelimiter>,'</FieldDelimiter>  
                     <FileExtension>csv</FileExtension>  
                 </DeviceInfo>  
               </Configuration>  
</Extension>  

4.Restart the SSRS

When you want to export a report to CSV format,choose the CSV (Pipe delimited).

Hope this helps！

If you have any question, please feel free to let me know.

If your problem has been solved, please mark "accepted answer" on my reply, thank you for your understanding.

Regards,

Zoe

Answer 2

I don't think it's for SSRS to protect Excel from CSV injection. The exported CSV is open to being edited by the attacker to add malicious code when opened in Excel. Unless your data that you're exporting already has malicious code in it that would get exported, in which case, couldn't you use SQL queries to check your source data that these codes do not exist, or has no way to enter by making your data entry processes disallow such code from entering.