Question: I'm working on a web application and we have an administrative feature that allows admins to import an excel spreadsheet containing information about sub-users they would like to add. We parse the spreadsheet and do basic input validation on most fields. We also ensure that the file has the correct extension before starting doing any deeper examination of the file.

I'm just curious if there are any other risks I'm overlooking when dealing with imported user data. Specifically importing Excel Spreadsheets.

Answer: 
I think the biggest risk I can think of is if that spreadsheet contains a malicious macro. 

Macros in Office have been exploitable for a long time, and recently Locky and a few other cryptolockers have taken to infecting users by macros in Word. I see no reason why the macro wouldn't work in other Office programs.

<https://medium.com/@networksecurity/locky-ransomware-virus-spreading-via-word-documents-51fcb75618d2#.eekz0ygoz>
A for instance of what to watch out for is illustrated by a patch released for Magento, SUPEE-5994 which addressed the following issue from exported, user entered content:

> 
> Attacker can provide input that executes a formula when exported and opened in a spreadsheet such as Microsoft Excel. The formula can modify data, export personal data to another site, or cause remote code execution. The spreadsheet usually displays a warning message, which the user must dismiss for the attack to succeed.
> 
> 
> 

So, the usual warnings apply, arbitrary content accepted from the web without proper mitigation can bear interesting surprises when opened in a spreadsheet program for which the malicious content is tailored.