Formula Injection: Spreadsheet Backdoors Enable RCE in Office and Grist-Core

The trusted spreadsheet, a cornerstone of global business operations, has become a potent weapon in the hands of threat actors. A sophisticated attack technique known as formula injection is being actively exploited to bypass critical security controls and achieve remote code execution (RCE) in widely used platforms, including Microsoft Office and the open-source Grist-Core. This trend underscores a fundamental shift: attackers are no longer just targeting operating systems or network services; they are weaponizing the very business logic and automation features upon which enterprises rely.

Microsoft Office Zero-Day: Bypassing the Last Line of Defense

Microsoft recently took the unusual step of releasing an emergency, out-of-band security update to address a critical vulnerability in its Office suite. This zero-day flaw was being actively exploited in limited, targeted attacks before a patch was available. The technical specifics are closely guarded, but security analysts confirm the attack chain involves a maliciously crafted document—such as a Word file or Excel spreadsheet.

The document exploits a memory corruption vulnerability or a logic flaw within Office's document parsing engine. Crucially, the exploit is designed to bypass Microsoft's robust "Protected View" security feature. Protected View is a sandboxed environment that opens documents from untrusted sources (like email attachments or the web) in a read-only mode, preventing automatic execution of embedded code. By circumventing this, the malicious document can execute arbitrary code with the privileges of the logged-in user, potentially leading to full system compromise, data theft, and lateral movement within a network. The rapid patch issuance and warnings from national cybersecurity agencies, like Romania's DNSC, highlight the severity and real-world risk this flaw posed to both individual and corporate users.

Grist-Core: Turning Spreadsheet Formulas into System Commands

Parallel to the Office threat, a critical vulnerability (CVE-2025-51747, CVSS score 9.8) was disclosed in Grist-Core, an innovative platform that combines the flexibility of a spreadsheet with the power of a database. This flaw represents a textbook case of formula injection. Grist-Core allows users to create powerful formulas for data manipulation. However, a lack of proper input sanitization and sandboxing in its formula execution engine created a path for privilege escalation.

An authenticated user with edit permissions could embed a specially crafted formula within a spreadsheet cell. This formula, when processed by the Grist server, could escape the intended calculation context and execute arbitrary operating system commands on the underlying server. Unlike client-side attacks in Office, exploiting Grist-Core provides direct server-side RCE. This means an attacker compromising a single user account could potentially take control of the entire Grist instance and the server hosting it, leading to catastrophic data breaches and further network infiltration.

The Common Threat: The Trusted Document as a Trojan Horse

The convergence of these incidents reveals a critical attack surface: the formula and document processing engines within productivity software. These components are engineered for performance and rich functionality, not as security boundaries. Attackers exploit this gap by embedding malicious payloads within elements the software is designed to trust and execute—be it document objects, cell formulas, or dynamic data connections.

This technique is highly effective because it preys on human and systemic trust. Employees are accustomed to opening spreadsheets and documents as part of their daily workflow. Security tools may be less vigilant against common file formats like .XLSX or .DOCX compared to executables. Furthermore, the attack can be staged: a document might download a second-stage payload from the internet only after bypassing Protected View, making static analysis harder.

Mitigation and Defense Strategies

For security teams, this evolving threat landscape demands a multi-layered response:

1. Immediate Patching: Apply the latest security updates from Microsoft for Office and from the Grist project immediately. This is the most critical step.
2. Principle of Least Privilege: Restrict user permissions both on endpoints and in applications like Grist. No user should have write or edit access unless absolutely necessary.
3. Hardening Application Security: For Office, ensure Protected View and other security settings (like macro blocking from the internet) are enforced via Group Policy. For self-hosted platforms like Grist, implement strict network segmentation and run the service with minimal OS privileges.
4. User Awareness and Technical Controls: Train users to be wary of unsolicited documents, even from seemingly known contacts. Deploy advanced email security gateways that can analyze document content for malicious code. Consider application allowlisting to prevent unauthorized software execution.
5. Active Monitoring: Monitor for unusual process spawns from Office applications (like WINWORD.EXE or EXCEL.EXE launching PowerShell) and for anomalous network connections originating from application servers.

The era of the malicious spreadsheet is here. As business tools become more powerful and interconnected, their attack surface expands proportionally. Defending against formula injection and document-based RCE requires moving beyond traditional malware detection and embracing a security model that questions the inherent trust placed in everyday business files.