csv-formula-injection

A security-testing skill covering CSV and spreadsheet formula injection, including DDE-style attacks in Excel and LibreOffice Calc and IMPORT-function abuse in Google Sheets. It applies when application exports, imports, or user-controlled fields feed spreadsheets or reporting tools, and it repeatedly stresses that testing should only be performed where explicitly authorized because payloads that invoke local commands or remote fetches are impactful. Lab targets and documented consent are the preferred approach.

The core idea is that certain leading characters can trigger formula evaluation when a cell is opened in spreadsheet software: the equals sign, plus, minus, and at symbol. It shows benign test cells (such as =1+1 or +1+1) to detect evaluation, then covers DDE and external-call patterns for controlled lab reproduction, obfuscation techniques that add spacing or dispersed characters to evade defensive parsers, and Google Sheets functions like IMPORTXML, IMPORTRANGE, IMPORTHTML, IMPORTFEED, and IMPORTDATA that can cause outbound requests or cross-document data pulls.

A testing methodology walks through mapping sinks that emit CSV, XLSX, or tab-separated output, tracing user-controlled fields, injecting formula prefixes starting with benign arithmetic and escalating only per program rules, opening results in the target software matching the victim workflow, and capturing evidence such as calculated results, security warnings, or DDE prompts. The defense section recommends prefixing fields with a single quote or tab, stripping or neutralizing leading trigger characters at export time, consistent CSV encoding and column-type validation, and user education about external data and DDE.