1

I'm allowing users to upload CSV files. Other users can download these files. I'm aware that CSV could be an attack vector.

Would a ClamAV (or other AV) scan offer protection against such a file?

Any scan would happen only after validating the MIME type.

AleksanderCH
  • 711
  • 3
  • 10
  • 23
Ben
  • 13
  • 2
  • 1
    Have you already tried it yourself? Or searched in the ClamAV documentation? – Sjoerd Mar 12 '19 at 12:56
  • 1
    The question is also posted here: https://stackoverflow.com/questions/55067124/can-clamav-detect-csv-injection – LLub Mar 12 '19 at 20:10

1 Answers1

5

ClamAV has, as far as I know, no specific detection features for CSV files. CSV injection is not a vulnerability that an AV would resolve directly. Instead, an AV may detect known malicious macro payloads that were injected into a file, regardless of the file type.

If you want to know about specific detection features, I suggest talking to the ClamAV maintainers. For now, I recommend following OWASP's advice on filtering: do not allow any cell to start with -, +, =, or @.

Polynomial
  • 132,208
  • 43
  • 298
  • 379