# CSV Injection at the CSV export feature

CSV export field escaping bypassed via a crafted ticket title containing `";` that splits the quoted field, letting Excel execute a formula command.

- Payout: hidden
- Severity: low
- Program: HackerOne
- Found by: niemand_sec
- Disclosed: 2019-04-08
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/118582
- Library page: https://bugbountylibrary.com/r/h1%3A118582
- Tags: area:web domain:web impact:rce kind:bounty platform:hackerone sev:low tech:payment technique:incomplete-fix vuln:command-injection

**Target:** CSV export feature of hackerone.com
**Root cause:** The CSV exporter quotes fields and escapes embedded quotes, but does not neutralize formula-triggering content; a title containing `";` breaks out of the quoted field so Excel re-parses the remainder as a formula.
**Steps:**
1. Create a ticket with title `":";-3+3+cmd|' /C calc'!D2`
2. Export the ticket list to CSV
3. Open the CSV in Excel (2013/2016 tested); the `;` splits the quoted field and the formula executes
**How found:** Researcher revisited prior CSV injection fixes (#72785, #111192) and hypothesized that the `"` encapsulation plus `,` separator could be broken by injecting `;` inside a quoted field, testing against Excel 2013/2016.
**Exploitation:** Attacker submits a ticket whose title embeds a quote-semicolon sequence; when a response team exports and opens the CSV in Excel, the field is split and the injected formula runs a command (`cmd|' /C calc'!D2`), executing code on the victim's machine.
**Insight:** When a CSV exporter quotes fields, test whether locale-specific separators (e.g. `;`) inside a quoted field can break Excel's parsing and re-enable formula injection despite quote-escaping mitigations.