Executive brief
connect is a popular Node.js middleware framework used to build web applications and APIs. A Cross-Site Scripting (XSS) vulnerability in the directory listing middleware allows attackers to inject malicious scripts into responses when serving directory listings, potentially compromising end-user browsers and enabling session hijacking or credential theft.
Technical details
The connect node module before version 2.14.0 contains a Cross-Site Scripting (CWE-79) vulnerability in the directory.js middleware due to insufficient validation and encoding of file path parameters. The vulnerability is network-reachable and requires user interaction (victim viewing a crafted directory listing), but does not require authentication. An attacker can craft a malicious filename or path containing JavaScript code that is reflected in the directory listing HTML without proper escaping, allowing script execution in the victim's browser. The vulnerability has been fixed in version 2.14.0 and later.
Affected products
- Node.js connect before 2.14.0
Timeline
- 2018-06-07: disclosed
- 2018-07-26: patched: Version 2.14.0 released with fix