Description
Dirsearch 0.4.1 contains a CSV injection vulnerability when using the --csv-report flag that allows attackers to inject formulas through redirected endpoints. Attackers can craft malicious server redirects with comma-separated paths containing Excel formulas to manipulate the generated CSV report.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| maurosoria | dirsearch | 0.4.1 | — |
References
- ExploitDB-49370 exploit
- dirsearch GitHub Repository product
- VulnCheck Advisory: dirsearch 0.4.1 - CSV Injection third-party-advisory