Dirsearch CSV Injection Vulnerability

A CSV injection vulnerability has been identified in Dirsearch version 0.4.1. When the --csv-report flag is used, the tool generates a CSV file that includes data from crawled endpoints. However, this data is not properly sanitized. Attackers can exploit this vulnerability by creating malicious server redirects that include comma-separated paths with Excel formulas. These crafted redirects can manipulate the structure of the generated CSV report, potentially leading to unintended consequences.

Impact

Exploitation of this vulnerability allows for CSV injection, where an attacker can inject malicious formulas into a CSV report that Dirsearch generates.

Reproduction

To reproduce this vulnerability, first set up a malicious server that redirects to a URL containing a comma and an Excel formula, such as '/test,=1336+1'. Then, run Dirsearch with the --csv-report flag directed at the server. The injected formula will be executed when the CSV file is opened in Excel.