CSV Command Injection In Twitter

Twitter allows users to export analytics of there tweets as a CSV file. By injecting a payload into a Tweet

Create a new tweet with the command -2+3+cmd|' /C calc'!D2.
Click on Export Data on the top-right of the page. (I've attached that file).
Open the .CSV file on a Windows machine.

Possible Fix:
Prefix =, +, - and @ symbols with a ' in issues when exporting them to a .CSV file.
Ensure all fields are properly "escaped" before returning the CSV file to the user.

This report is reported to Twitter via HackerOne in October 2018. They closed this report as in informative but the problem still exists here because Excel needs to handle this.

I write more at Muhaddis.Info

LinkedIn, Twitter, Facebook, Instagram: @MuhaddiMu