Formula Injection on Azure

Formula injection occurs when untrusted data is placed directly into a spreadsheet formula without proper sanitization. When the resulting file is opened in Excel (or a compatible viewer), the formula executes, potentially launching arbitrary commands or exfiltrating data. In Azure environments, this pattern commonly appears in services that generate Excel files on‑the‑fly, such as Azure Functions, Azure Logic Apps, or Azure App Service web APIs that export data to .xlsx for downstream consumption.

Consider an Azure Function that receives a query parameter representing a sales figure and writes it into an Excel cell as part of a formula:

using System.IO;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Azure.WebJobs;
using Microsoft.Azure.WebJobs.Extensions.Http;
using Microsoft.AspNetCore.Http;
using ClosedXML.Excel;

public static class ExportSalesFunction
{
    [FunctionName("ExportSales")]
    public static async Task Run(
        [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = null)] HttpRequest req,
        ILogger log)
    {
        string sales = req.Query["sales"]; // user‑controlled input
        using var workbook = new XLWorkbook();
        var worksheet = workbook.Worksheets.Add("Sales");
        // VULNERABLE: user input is concatenated directly into a formula string
        string formula = "=SUM(" + sales + ")";
        worksheet.Cell("A1").SetValue(formula); // Excel interprets this as a formula
        using var stream = new MemoryStream();
        workbook.SaveAs(stream);
        stream.Position = 0;
        return new FileStreamResult(stream, "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet")
        {
            FileDownloadName = "sales.xlsx"
        };
    }
}

If an attacker supplies a value like +cmd|' /C calc'!A0, the resulting cell contains =SUM(+cmd|' /C calc'!A0). When the file is opened, Excel treats the leading + as a formula initiator and attempts to execute the embedded command, launching calc.exe (or any other payload). Similar payloads work with =, -, @, or a tab character.

Azure‑specific pathways where this shows up include:

• Azure Functions that generate reports for Power BI or downstream analytics.
• Azure Logic Apps that use the "Create CSV table" or "Create HTML table" actions followed by a custom connector that writes to Excel.
• Azure App Service APIs that export database query results to Excel via EPPlus or Open XML SDK.
• Azure Data Factory pipelines that produce Excel files for business users.

The root cause is always the same: user‑supplied data is inserted into a formula string without validation or escaping.

Detecting formula injection in Azure‑hosted APIs relies on observing whether user input ever reaches a cell’s formula syntax. Since middleBrick performs unauthenticated, black‑box scanning, it can identify the issue by probing endpoints that accept parameters and return Excel‑like content.

When middleBrick scans an endpoint, it runs its "Input Validation" check (one of the 12 parallel checks). The scanner sends a series of safe payloads that begin with formula‑triggering characters (=, +, -, @, \t) and monitors the response for signs that the payload was reflected unchanged inside a formula context. For example, if a GET request /api/export?sales=TEST returns an Excel file, middleBrick will also request /api/export?sales=%3Dcmd%7C'%20/C%20calc'!A0 (URL‑encoded =cmd|' /C calc'!A0) and inspect the returned workbook.

If the scanner detects that the payload appears as part of a formula string in the generated .xlsx (by parsing the Open XML package or by observing that Excel would treat it as a formula), it flags the finding with:

• Severity: Medium (requires user to open the file).
• Category: Input Validation.
• Remediation guidance: sanitize or neutralize formula‑triggering characters before embedding data into a formula.

Because middleBrick does not need agents, credentials, or configuration, a developer can simply paste the public URL of an Azure Function or API and receive a report within 5–15 seconds that highlights any formula‑injection vectors.

Example of a middleBrick CLI command that would trigger the scan:

middlebrick scan https://myapp.azurewebsites.net/api/export

The output will include a finding similar to:

Input Validation – Formula Injection
Severity: Medium
Location: GET /api/export?sales
Description: User‑controlled "sales" parameter is concatenated directly into an Excel formula without sanitization.
Remediation: Ensure the parameter does not start with =, +, -, @, or a tab character; or set the cell value as a string instead of a formula.