CVE-2021-47901: Dirsearch CSV Injection Vulnerability

CVE-2021-47901 Overview

CVE-2021-47901 is a CSV injection vulnerability in Dirsearch 0.4.1, a popular open-source web path brute-forcing tool. The flaw exists in the --csv-report output functionality. When Dirsearch follows server-issued redirects, it writes the redirect target into the CSV report without sanitizing spreadsheet metacharacters. An attacker controlling a web server can return crafted redirects containing Excel formulas. When a security analyst later opens the generated CSV file in a spreadsheet application, the embedded formulas execute. This vulnerability is tracked under [CWE-1236: Improper Neutralization of Formula Elements in a CSV File].

Critical Impact
Adversaries who control a scanned web server can execute arbitrary spreadsheet formulas on the analyst workstation that opens the CSV report, enabling data exfiltration or command execution through spreadsheet features.

Affected Products

Dirsearch 0.4.1
Earlier Dirsearch builds that share the --csv-report code path
Downstream tooling and pipelines that consume Dirsearch CSV output without sanitization

Discovery Timeline

2026-01-27 - CVE-2021-47901 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2021-47901

Vulnerability Analysis

Dirsearch enumerates directories and files on a target web server by issuing HTTP requests against a wordlist. When invoked with --csv-report, the tool records each response, including any redirect target returned by the server, into a comma-separated values file. The redirect path is written verbatim into a CSV cell. CSV parsers in Microsoft Excel, LibreOffice Calc, and Google Sheets interpret cells beginning with =, +, -, or @ as formulas. An attacker who controls the responding server can craft a Location header whose path begins with one of these characters and contains commas to span multiple cells. When the operator opens the report, the spreadsheet engine evaluates the attacker-supplied formula. Formulas can call HYPERLINK, WEBSERVICE, or DDE handlers to exfiltrate adjacent cell data or trigger command execution prompts.

Root Cause

Dirsearch does not neutralize formula prefix characters before serializing redirect targets into the CSV report. The output layer trusts server-controlled response data and writes it without escaping leading metacharacters or quoting fields that contain commas embedded by the attacker.

Attack Vector

Exploitation requires the attacker to operate a web server that the victim scans with Dirsearch using --csv-report. The attacker configures the server to issue an HTTP redirect whose target path contains a formula payload such as =cmd|'/C calc'!A1 along with commas to break field boundaries. The payload is logged into the CSV file. The vulnerability triggers only when the resulting report is opened by a human analyst in a spreadsheet application, which classifies this as a user-interaction-required attack chain.

No verified proof-of-concept code is reproduced here. Technical details are available in the Exploit-DB #49370 entry and the VulnCheck Advisory for dirsearch.

Detection Methods for CVE-2021-47901

Indicators of Compromise

CSV report files produced by Dirsearch containing cells that begin with =, +, -, or @ in the redirect or path columns.
Spreadsheet processes such as excel.exe or soffice.bin spawning child processes like cmd.exe, powershell.exe, or network utilities shortly after opening a Dirsearch report.
Outbound network connections initiated by spreadsheet applications to attacker-controlled domains referenced in formula payloads.

Detection Strategies

Scan Dirsearch CSV outputs for cells whose first character is a formula trigger and quarantine matching files before analyst review.
Hunt for parent-child process relationships where Office or LibreOffice binaries launch shells, scripting engines, or HTTP clients.
Inspect HTTP proxy logs for redirect responses whose Location header values include =, WEBSERVICE(, HYPERLINK(, or embedded commas during reconnaissance activity.

Monitoring Recommendations

Alert on spreadsheet application processes generating outbound DNS or HTTP traffic on workstations used for security tooling.
Log and review all uses of dirsearch --csv-report in operator command histories and centralize scan artifacts for sanitization.
Monitor for the creation of .csv files in directories associated with web reconnaissance tooling and apply file-content inspection rules.

How to Mitigate CVE-2021-47901

Immediate Actions Required

Stop using the --csv-report flag in Dirsearch 0.4.1 against untrusted targets until reports can be sanitized.
Sanitize existing CSV reports by prefixing any cell beginning with =, +, -, or @ with a single quote before opening in a spreadsheet application.
Open Dirsearch reports in a plain text editor or import them into spreadsheets with formula evaluation disabled.
Upgrade Dirsearch to the latest release from the GitHub Directory Search Tool repository, which addresses output sanitization.

Patch Information

The Dirsearch maintainers track fixes through the project repository. Operators should pull the current main branch from the GitHub Directory Search Tool and review release notes for CSV output handling. The VulnCheck Advisory for dirsearch provides additional remediation context.

Workarounds

Use alternative report formats such as --json-report or --plain-text-report that do not feed spreadsheet parsers.
Configure spreadsheet applications to disable Dynamic Data Exchange (DDE), WEBSERVICE, and external link evaluation by default.
Run Dirsearch from isolated scanning hosts and review reports only on workstations with macro and formula execution disabled.

bash

# Configuration example: sanitize a Dirsearch CSV report before review
awk 'BEGIN{FS=OFS=","} {for(i=1;i<=NF;i++) if($i ~ /^[=+\-@]/) $i="'\''"$i; print}' \
    report.csv > report.sanitized.csv