Collected research

Server-Side Spreadsheet Injection - Formula Injection to Remote Code Execution - Bishop Fox

Server-Side Spreadsheet Injection - Formula Injection to Remote Code…

@bishopfox · Bishop Fox

Formula injection becomes a server side problem when an application builds or converts spreadsheets itself. A payload in an exported Google Sheet exfiltrates the whole sheet live through IMPORTDATA, and on servers that render uploaded XLS or CSV files with real Excel a DDE formula gives command execution, chained over DNS when outbound TCP is blocked.

Record

Document

Server-Side Spreadsheet Injection - Formula Injection to Remote Code…

Researcher

@bishopfox

Published by

Bishop Fox

Topic

Injection

In the archive

• Collected in the 2018 research round

Tags

• command-injection
• rce
• injection
• file-upload
• ssrf
• info-leak
• attack-chain
• case-study
• owasp-a03-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of @bishopfox, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.