PT-2021-15542 · Unknown · Html-To-Csv

0Xbughunter · Published 2021-11-26 · Updated 2021-12-20 · CVE-2021-23654

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions html-to-csv versions all

Description The issue arises when a formula is embedded in an HTML page and gets accepted without validation, allowing it to be pushed into a CSV file during conversion. This enables a malicious actor to embed or generate malicious links or execute commands via CSV files.

Recommendations For all versions, consider disabling the conversion of HTML pages with embedded formulas to CSV files until a proper validation mechanism is implemented to prevent malicious links or command execution. Restrict access to the CSV file generation feature to minimize the risk of exploitation. Avoid using the html-to-csv package for converting HTML pages with embedded formulas until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2021-23654

GHSA-FWF6-RW69-HHJ4

PYSEC-2021-866

SNYK-PYTHON-HTMLTOCSV-1582784

Affected Products

Html-To-Csv

References · 11

• 🔥 https://github.com/hanwentao/html2csv/blob/master/html2csv/converter.py · Exploit
• 🔥 https://snyk.io/vuln/SNYK-PYTHON-HTMLTOCSV-1582784 · Exploit
• https://osv.dev/vulnerability/GHSA-fwf6-rw69-hhj4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23654 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23654 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-866 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/html-to-csv/PYSEC-2021-866.yaml · Note
• https://github.com/hanwentao/html2csv/issues/9 · Note
• https://github.com/hanwentao/html2csv · Note
• https://github.com/advisories/GHSA-fwf6-rw69-hhj4 · Note
• https://t.me/cvenotify/23828 · Telegram Post