CSV Formula Injection for Bug Bounty: Impact That Triagers Accept
Export-as-CSV features love to concatenate user fields into cells. If a cell begins with =, +, -, or @, Excel and friends may treat it as a formula. That is CWE-1236 / CSV injection. OWASP documents the pattern clearly; programs argue endlessly about severity.
Your job is not to win a theoretical debate — it is to show a realistic victim path.
Finding the sink
Anywhere an admin or partner downloads tabular data:
- User display names, comments, ticket titles
- Address lines and company fields
- Survey free-text answers
- Billing descriptors
Create a record with a payload like:
=cmd|'/c calc'!A0
or a safer modern demo that only calls =HYPERLINK("https://collaborator/...","Click") depending on what the program allows. Prefer non-destructive proofs.
Download the CSV as the privileged role. Open in Excel with macros/formula warnings noted — many orgs still click Enable.
Impact stories that work
- Admin opens exporter daily — payload from a low-privilege user runs in the admin’s spreadsheet context (credential phishing via
HYPERLINK, or worse on old DDE chains). - Finance imports CSV into another system — formula breaks automation or injects unexpected values.
- Round-trip — app re-imports the CSV and evaluates something server-side (rare; huge if real).
If nobody privileged will ever open the file, expect Low. Say so honestly or chain it with an admin-only export that must be reviewed for support workflows.
What good remediation looks like
Prefix risky leading characters with a single quote or tab, or encode cells so spreadsheets treat them as text. Validate on input and escape on export — attackers bypass input filters with alternate Unicode looks sometimes, but export escaping is the reliable control.
Report structure
- Steps to plant the cell
- Exported file attached (or screenshot of formula bar)
- Who opens it in the product’s normal workflow
- Reference OWASP CSV Injection
I file CSV injection when an admin export is in play. Random “profile name breaks Excel” without an operator victim usually wastes everyone’s time — including mine.