I have found a nice macro injection vulnerability in an Excel export functionality. I can inject =1+1 (or worse) into the exported Excel file.
But when opening the file in Excel the formula isn't directly evaluated at startup, it is shown as text. Only after someone double clicks the cell and presses enter is the formula evaluated and the content of the cell changes to 2 (or calc starts up depending on the payload).
I only have access to "newer" versions of Excel (2010 and 365). The Excel versions that I tried have automatic function evaluation on (so normally a function is evaluated directly). The installs are default installations, not super secure.
I think this is still a vulnerability that needs to be fixed, but if it only works when a user does something stupid, then the risk would be something like Medium. While if it would execute directly when opening the file (with a pop-up or whatever) it would be a critical vulnerability that needs to be solved ASAP.
My question is: Is this something that all versions of Excel do? (showing the formula in text and not evaluating automatically). Or would it still be critical in older versions, but new versions need more user input?
Bonus question: Does anyone now a payload that would overwrite this "non evaluate at startup" annoying functionality?
EDIT: Ok after a comment by schroeder I get that this might not be construed as purely security. So let us focus on this part of the exploit: How could I leverage this vulnerability into an exploit? Are there ways to trick people into clicking on the cells and evaluating the functions?