Is CVE-2024-43799 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-43799 being exploited in the wild.

How severe is CVE-2024-43799?

Low severity, with a CVSS score of 3.1, published 10 September 2024.

Which products and versions are affected?

Send SEMVER:introduced=0,fixed=0.19.0.

Is there a fix for CVE-2024-43799?

Yes. Send: upgrade to 0.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-43799 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-43799?

Check whether you run Send at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-43799: send template injection leading to XSS

CVE-2024-43799 · Severity: low · CVSS 3.1 · Published 2024-09-10

send is a Node.js library used to serve static files and handle HTTP redirects in web applications. The vulnerability allows attackers to inject malicious template code through redirect URLs, enabling them to execute arbitrary JavaScript in users' browsers. Exploitation requires attackers to control the redirect input and victims must click a link in a template before the browser completes the redirect.

Technologies: Send.

Quick answers

Is CVE-2024-43799 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-43799 being exploited in the wild.
How severe is CVE-2024-43799?: Low severity, with a CVSS score of 3.1, published 10 September 2024.
Which products and versions are affected?: Send SEMVER:introduced=0,fixed=0.19.0.
Is there a fix for CVE-2024-43799?: Yes. Send: upgrade to 0.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-43799 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-43799?: Check whether you run Send at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Send: upgrade to 0.19.0 or later

Technical details

The vulnerability is a template injection flaw (CWE-79) in the send library's redirect handling mechanism. When untrusted user input is passed to SendStream.redirect(), the library fails to properly sanitize template expressions, allowing XSS payload injection. Attack requires control over the redirect URL parameter, no authentication, network reachability, and user interaction (clicking a link). The attacker must also ensure the application does not redirect before the template is rendered. Patches are available in send version 0.19.0 and later.

Affected products

pillarjs send before 0.19.0

Identifiers

CVE-2024-43799
GHSA-m6fv-jmcg-4jfg

Timeline

2024-09-10: disclosed
2024-09-10: patched: Version 0.19.0 released

References

https://github.com/pillarjs/send/security/advisories/GHSA-m6fv-jmcg-4jfg

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.