Question: I'm working on a web application and we have an administrative feature that allows admins to import an excel spreadsheet containing information about sub-users they would like to add. We parse the spreadsheet and do basic input validation on most fields. We also ensure that the file has the correct extension before starting doing any deeper examination of the file.

I'm just curious if there are any other risks I'm overlooking when dealing with imported user data. Specifically importing Excel Spreadsheets.

Answer: 
While Austin is correct, it is also a risk that the file itself contains an exploit. Office applications are utterly **massive** and have a truly humungous attack surface area. If you have time on your hands, open up an instrumented fuzzer like American Fuzzy Lop (AFL) and run it on your Excel processor. You will find a stunning amount of very scary-looking crashes.

You have to assess your risk here. If you are defending against someone who only has the skills to write a malicious macro, you probably don't have much to worry about. If you are defending against someone who knows a thing or two about software exploitation and you are their target, you opening their spreadsheets will be a dream come true.
A for instance of what to watch out for is illustrated by a patch released for Magento, SUPEE-5994 which addressed the following issue from exported, user entered content:

> 
> Attacker can provide input that executes a formula when exported and opened in a spreadsheet such as Microsoft Excel. The formula can modify data, export personal data to another site, or cause remote code execution. The spreadsheet usually displays a warning message, which the user must dismiss for the attack to succeed.
> 
> 
> 

So, the usual warnings apply, arbitrary content accepted from the web without proper mitigation can bear interesting surprises when opened in a spreadsheet program for which the malicious content is tailored.