# CSV Injection via the CSV export feature

Newline prefix in a HackerOne report title bypassed the CSV-injection fix, so exported CSV cells became active formulas that could execute commands when opened.

- Payout: hidden
- Severity: medium
- Program: HackerOne
- Found by: zombiehelp54
- Disclosed: 2016-02-16
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/111192
- Library page: https://bugbountylibrary.com/r/h1%3A111192
- Tags: area:web domain:web impact:rce kind:bounty platform:hackerone sev:medium tech:rest technique:incomplete-fix vuln:command-injection

**Target:** CSV export of reports
**Root cause:** The prior fix filtered formula-leading characters at the start of a cell but did not account for a leading newline (0x0a), which spreadsheet apps treat as a cell boundary, so the following `-2+3+cmd|' /C calc'!D2` is parsed as an active formula.
**Steps:**
1. Submit a report with title `%0A-2+3+cmd|' /C calc'!D2` via `POST /security/reports/` with `report[title]=%0A-2%2B3%2Bcmd%7C'+%2FC+calc'!D2`.
2. As a response team, open Reports page and export the report as CSV.
3. Open the CSV in a spreadsheet; the cell evaluates the formula and triggers the DDE command.
**How found:** Researcher revisited the earlier CSV-injection fix (#72785) and tested whether a leading newline character would slip past the formula-prefix filter, since spreadsheets treat newlines as cell delimiters.
**Exploitation:** Attacker submits a report whose title begins with a newline followed by a DDE formula; when a triager exports reports to CSV and opens it in Excel, the formula executes `calc` (arbitrary command) on the victim's machine.
**Insight:** When a CSV-injection fix only blocks leading `= + - @`, test control characters (newline, tab, CR) before the formula — spreadsheet parsers treat them as cell boundaries and re-evaluate the remainder as a formula.