CVE-2020-36941
CRITICALKnockpy 4.1.1 - CSV Injection via Server Header Manipulation
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2020-36941. PoCs published by Dolev Farhi.
AI-analyzed exploit summary This is a technical writeup detailing a CSV injection vulnerability in Knockpy 4.1.1, where unfiltered Server HTTP Response Headers are reflected into CSV output. The author provides vulnerable code segments and an example malicious Nginx configuration to exploit the issue.
Description
Knockpy 4.1.1 contains a CSV injection vulnerability that allows attackers to inject malicious formulas into CSV reports through unfiltered server headers. Attackers can manipulate server response headers to include spreadsheet formulas that will execute when the CSV is opened in spreadsheet applications.
Exploits (1)
This is a technical writeup detailing a CSV injection vulnerability in Knockpy 4.1.1, where unfiltered Server HTTP Response Headers are reflected into CSV output. The author provides vulnerable code segments and an example malicious Nginx configuration to exploit the issue.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H