Summary
A CSV/Formula Injection vulnerability exists in the profile fields of the application. User-supplied input containing spreadsheet formulas is accepted and stored without proper sanitisation. When this data is exported to a CSV file and opened in spreadsheet software such as Microsoft Excel or LibreOffice Calc, the embedded formula is interpreted and executed instead of being treated as plain text.
This allows an attacker to inject malicious spreadsheet formulas that can trigger external requests, manipulate spreadsheet contents, or deceive users into interacting with attacker-controlled resources.
Vulnerable Payload
=HYPERLINK("http://example.com","click")
Steps to Reproduce
Log in to an AmpleNote account.
Navigate to:
https:
Locate a profile field that is later included in exported CSV data (such as Name or another user-controlled field).
Enter the following payload:
=HYPERLINK("http://example.com","click")
Save the profile.
Export the affected data to CSV (or access any administrative CSV export containing the stored value).
Open the exported CSV file using Microsoft Excel or another spreadsheet application.
Observe that the spreadsheet interprets the value as a formula rather than displaying it as plain text.
Expected Result
User input should be treated as plain text. Any value beginning with spreadsheet formula characters (=, +, -, or @) should be neutralised before being included in CSV exports.
Actual Result
The application exports the malicious payload without sanitisation, allowing spreadsheet software to execute the injected formula.
Security Impact
Successful exploitation could allow an attacker to:
Execute spreadsheet formulas when exported files are opened.
Create deceptive hyperlinks leading to attacker-controlled websites.
Trick administrators into clicking malicious links.
Leak information through external requests initiated by spreadsheet formulas.
Modify spreadsheet content or interfere with data integrity.
Conduct phishing or social engineering attacks against internal staff.
Increase the risk of further compromise depending on spreadsheet application behaviour and security settings.
Business Impact
Administrative users may unknowingly interact with malicious content.
Sensitive organisational workflows involving exported reports become less trustworthy.
Increased risk of phishing and credential theft.
Loss of confidence in exported reporting features.
Potential reputational damage if customer data exports can contain malicious formulas.
Additional incident response and remediation costs.
Proof of Concept
Payload used:
=HYPERLINK("http://example.com","click")
When the exported CSV file is opened in a spreadsheet application, the payload is interpreted as a clickable hyperlink formula instead of plain text.
Root Cause
The application does not properly neutralise spreadsheet formula characters before exporting user-controlled data into CSV files. Spreadsheet applications automatically evaluate cells beginning with special characters such as:
=
+
-
@
This allows attacker-controlled formulas to execute.
Remediation
Escape or neutralise all user-controlled values before CSV export.
Prefix potentially dangerous values with a single quotation mark (') so they are treated as plain text.
Validate and sanitise exported data containing spreadsheet formula prefixes.
Perform server-side sanitisation rather than relying on client-side controls.
Review all CSV export functionality for similar injection issues.
Add security tests to prevent regression.
CVSS v3.1
Score: 8.1 (High)
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
CWE
CWE-1236: Improper Neutralization of Formula Elements in a CSV File
OWASP Category
Injection
References
CWE-1236 – Improper Neutralization of Formula Elements in a CSV File
OWASP CSV Injection (Formula Injection) Guidance