csv-formula-injection

To test for CSV formula injection, inject malicious formula payloads into application inputs and verify if they execute when the exported CSV or XLSX files are opened in spreadsheet tools. This validates if untrusted data triggers command execution or data exfiltration.

CSV injection is a security vulnerability where untrusted data containing formula prefixes triggers arbitrary command execution when exported files are opened. DDE injection exploits Dynamic Data Exchange protocols in desktop spreadsheet tools like Excel or LibreOffice Calc to execute system commands.

Yes, you can test Google Sheets IMPORT* function abuse by injecting payload formulas into application inputs. This detects whether exported cloud spreadsheet integrations allow unauthorized data exfiltration through malicious IMPORT functions fetching external data sources.

Bypass CSV injection sanitization by applying obfuscation techniques like whitespace padding, dispersed formula characters, or rundll32-style payloads. Testing these bypass methods validates whether defensive parsers incorrectly sanitize or block malicious formula prefix triggers in exported data.

CSV formula injection testing works across applications that export or import CSV, XLSX, or tab-separated data, including admin billing exports and audit logs. It identifies if user-controlled fields reflect formula payloads that execute upon file opening.

Spreadsheet formula injection testing is limited by the target application's export sanitization controls and the specific spreadsheet tool used to open files. Execution behavior varies between Excel, LibreOffice Calc, and Google Sheets, requiring platform-specific payload validation.