---
id: 4225
title: "Server-Side Spreadsheet Injection - Formula Injection to Remote Code Execution"
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/server-side-spreadsheet-injections"
published_at: "2018-06-11T00:00:00Z"
tags: ["rce", "appsec", "data-exfiltration", "csv-injection", "formula-injection", "google-sheets"]
phying_url: "https://phying.com/item/4225"
lang: en
---

# Server-Side Spreadsheet Injection - Formula Injection to Remote Code Execution

## Summary

Jake Miller details server-side spreadsheet injection: formula payloads exfiltrated data from a Google Sheets workflow, and in two apps led to remote code execution.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **Published:** 2018-06-11T00:00:00Z
- **Original:** https://bishopfox.com/blog/server-side-spreadsheet-injections
- **Phying News:** https://phying.com/item/4225