Executive brief
Restify is a Node.js web framework used to build REST APIs and web services. The framework fails to properly escape user input in error messages displayed when a request URL is not found, allowing attackers to inject malicious scripts that execute in users' browsers when they visit a crafted URL.
Technical details
This is a cross-site scripting (XSS) vulnerability in restify's error handler, specifically the ResourceNotFoundError response. When a request targets a non-existent URL, restify includes the unsanitized URL in the error response. An attacker can craft a URL containing URL-encoded script tags (e.g., %22%3E%3Cscript%3E...%3C/script%3E), which are partially escaped in the HTML response but retain enough structure for browsers to execute. The vulnerability requires user interaction (visiting a malicious link) and affects all requests to non-existent endpoints. The fix is available in restify version 4.1.0 and later, which properly sanitizes the URL before including it in error messages.
Affected products
- restify restify 2.0.0 to 4.0.4
Timeline
- 2016-02-25: disclosed: Issue reported on GitHub
- 2017: advisory: CVE-2017-16018 assigned
- 2017: patched: Fix available in restify 4.1.0