Quick answers
- Is CVE-2024-10491 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-10491 being exploited in the wild.
- How severe is CVE-2024-10491?
- Low severity, with a CVSS score of 3.1, published 29 October 2024.
- Which products and versions are affected?
- Express SEMVER:introduced=0,fixed=4.0.0-rc1.
- Is there a fix for CVE-2024-10491?
- Yes. Express: upgrade to 4.0.0-rc1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-10491 attacked?
- It is attacked over the network.
- Am I affected by CVE-2024-10491?
- Check whether you run Express at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Express: upgrade to 4.0.0-rc1 or later
Technical details
The vulnerability is a resource injection flaw (CWE-74) in the Express response.links function, stemming from insufficient sanitization of Link header values. Attackers can craft input containing special characters (commas, semicolons, angle brackets) to inject arbitrary resources into the Link header when unsanitized user-controlled data is passed to the function. The attack requires no authentication and is remotely exploitable over the network, affecting all Express versions prior to 4.0.0-rc1. Successful exploitation allows preloading of malicious resources and potential header injection, though the CVSS score of 3.1 (later reported as 4.0 Medium) suggests limited direct impact in many configurations.
Affected products
- Express Express <= 3.21.4
Identifiers
- CVE-2024-10491
- GHSA-cm5g-3pgc-8rg4
Timeline
- 2024-10-29: disclosed: Vulnerability published
- 2024-10-29: patched: Fix available in version 4.0.0-rc1