exploiting-csv-formula-injection

Submit benign arithmetic payloads like =1+1, +1+1, -1+1, and @SUM(1+1) into user-controlled fields, then download the CSV or Excel export and open it in Excel or LibreOffice. If the cell shows the computed result instead of the literal text, the field is vulnerable.

A cell is treated as a formula when it begins with =, +, -, or @. Filters that only strip = are bypassed by the other three characters, and leading spaces, tabs, or carriage returns are trimmed by Excel before parsing, defeating naive starts-with checks.

Yes. HYPERLINK and WEBSERVICE formulas leak adjacent cell contents to an attacker URL on click or on file open, with no macro warning in many configurations. Confirm the callback using an out-of-band listener such as Burp Collaborator, interactsh, or a logging web server.

Modern Excel shows warning prompts before launching external programs via =cmd|'/c calc'!A1, but users frequently click through, and legacy, registry-tweaked, or LibreOffice configurations may execute automatically. Validate behavior on a controlled victim VM, never production machines.

Common causes are the application neutralizing cells by prefixing a single quote, the payload landing mid-row instead of at a cell start, or the spreadsheet client blocking external content. Try comma/quote breakout to control the cell and test both Excel and LibreOffice.

Prefix every exported cell beginning with =, +, -, @, or leading whitespace with a single quote or tab to force literal text. Additionally escape quotes and commas per RFC 4180, serve downloads as text/csv with Content-Disposition: attachment, and disable DDE via Office group policy.