CVE-2024-43796: Express XSS via response.redirect()

CVE-2024-43796 · Severity: low · CVSS 3.1 · Published 2024-09-10

Express is a popular web application framework for Node.js used to build web servers and APIs. A vulnerability in the response.redirect() function allows attackers to inject and execute malicious scripts in the browser if untrusted user input is passed to this function, even after sanitization. Exploitation requires specific conditions including user interaction (clicking a link), but successful attacks could lead to session hijacking, credential theft, or malware infection.

Technologies: Express.

Quick answers

Is CVE-2024-43796 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-43796 being exploited in the wild.
How severe is CVE-2024-43796?
Low severity, with a CVSS score of 3.1, published 10 September 2024.
Which products and versions are affected?
Express SEMVER:introduced=0,fixed=4.20.0.
Is there a fix for CVE-2024-43796?
Yes. Express: upgrade to 4.20.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-43796 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-43796?
Check whether you run Express at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Express: upgrade to 4.20.0 or later

Technical details

A cross-site scripting (XSS) vulnerability exists in Express versions prior to 4.20.0 and 5.0.0-alpha.1 through 5.0.0-beta.x due to improper neutralization of user input in the response.redirect() function (CWE-79). The vulnerability allows an attacker controlling the redirect destination to inject arbitrary JavaScript code that executes in the user's browser. Exploitation requires multiple preconditions: the attacker must control the input to response.redirect(), Express must not complete the redirect before rendering a template, and the user must click on a link in that template. The fix was applied in Express 4.20.0 and 5.0.0, and users should upgrade to these patched versions immediately.

Affected products

  • Express Express <4.20.0, >=5.0.0-alpha.1 <5.0.0

Identifiers

  • CVE-2024-43796
  • GHSA-qw6h-vgh9-j6wx

Timeline

  • 2024-09-10: disclosed
  • 2024-09-10: patched: Express 4.20.0 and 5.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.