CVE-2021-47901
📋 TL;DR
Dirsearch 0.4.1 contains a CSV injection vulnerability that allows attackers to inject Excel formulas into generated CSV reports. When attackers control server redirects, they can manipulate the CSV output to potentially execute malicious formulas when opened in spreadsheet applications. This affects anyone using dirsearch with the --csv-report flag against attacker-controlled endpoints.
💻 Affected Systems
- Dirsearch
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers could execute arbitrary code on victim machines when CSV files are opened in vulnerable spreadsheet applications, potentially leading to full system compromise.
Likely Case
Data manipulation in CSV reports, formula execution in Excel/OpenOffice, or social engineering attacks via malicious spreadsheet content.
If Mitigated
Limited to CSV report manipulation without code execution if proper spreadsheet security settings are enabled.
🎯 Exploit Status
Exploit requires attacker to control server redirects and victim to open CSV in vulnerable spreadsheet application
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.4.2 and later
Vendor Advisory: https://github.com/maurosoria/dirsearch
Restart Required: No
Instructions:
1. Update dirsearch to version 0.4.2 or later
2. Run: pip install --upgrade dirsearch
3. Verify version with: dirsearch --version
🔧 Temporary Workarounds
Disable CSV reporting
allAvoid using --csv-report flag when scanning untrusted targets
Sanitize CSV output
allManually sanitize CSV files before opening in spreadsheet applications
🧯 If You Can't Patch
- Only use dirsearch against trusted, internal targets
- Open CSV files in plain text editors instead of spreadsheet applications
🔍 How to Verify
Check if Vulnerable:
Check dirsearch version: dirsearch --version | grep -q '0.4.1' && echo 'VULNERABLE'Check Version:
dirsearch --versionVerify Fix Applied:
Verify version is 0.4.2 or later: dirsearch --version📡 Detection & Monitoring
Log Indicators:
- CSV files with unusual formula patterns
- Dirsearch usage with --csv-report flag
Network Indicators:
- HTTP redirects to paths containing Excel formula syntax
SIEM Query:
process.name:dirsearch AND cmdline:*--csv-report*