Executive brief
Express, a popular web framework for Node.js applications, fails to specify a charset field in Content-Type headers for error responses. An attacker can exploit this omission to inject malicious scripts through non-standard character encodings (such as UTF-7), potentially compromising user sessions, stealing credentials, or redirecting users to malicious sites. This affects any website built with vulnerable versions of Express.
Technical details
Express versions prior to 3.11 and 4.x versions prior to 4.5 do not enforce a charset in the Content-Type header when sending HTTP 400-level error responses. This allows attackers to perform stored or reflected cross-site scripting (XSS) attacks by leveraging non-standard character encodings like UTF-7 to bypass the browser's default charset interpretation. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). An attacker can craft requests that trigger error responses containing JavaScript payloads encoded in UTF-7, which browsers will interpret and execute. The fix is to update Express to version 3.11 or later for the 3.x branch, or version 4.5 or later for the 4.x branch.
Affected products
- OpenJS Foundation Express 3.x < 3.11, 4.x < 4.5
Timeline
- 2014: disclosed: Vulnerability initially discovered
- 2018-10-23: advisory: GHSA advisory published