CVE-2021-47901

Summary

Dirsearch 0.4.1 contains a CSV injection vulnerability when using the –csv-report flag that allows attackers to inject formulas through redirected endpoints. Attackers can craft malicious server redirects with comma-separated paths containing Excel formulas to manipulate the generated CSV report.

Affected Software

VendorProductVersion RangeStatus
maurosoriadirsearch0.4.1affected

Weaknesses

  • CWE-1236: Improper Neutralization of Formula Elements in a CSV File

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: total

References