Is CVE-2024-43800 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-43800 being exploited in the wild.

How severe is CVE-2024-43800?

Low severity, with a CVSS score of 3.1, published 10 September 2024.

Which products and versions are affected?

serve-static (npm) SEMVER:introduced=0,fixed=1.16.0.

Is there a fix for CVE-2024-43800?

Yes. serve-static (npm): upgrade to 1.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-43800 attacked?

It is attacked over the network.

Am I affected by CVE-2024-43800?

Check whether you run serve-static (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-43800: serve-static template injection leading to XSS

CVE-2024-43800 · Severity: low · CVSS 3.1 · Published 2024-09-10

serve-static is a Node.js middleware used to serve static files in Express web applications. A template injection vulnerability in the redirect() function can allow attackers to execute arbitrary code in users' browsers if the application passes untrusted input to the redirect function without proper validation. Successful exploitation requires an attacker to control the redirect input, the browser to delay redirecting, and a user to click a malicious link.

Vendors: npm.

Quick answers

Is CVE-2024-43800 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-43800 being exploited in the wild.
How severe is CVE-2024-43800?: Low severity, with a CVSS score of 3.1, published 10 September 2024.
Which products and versions are affected?: serve-static (npm) SEMVER:introduced=0,fixed=1.16.0.
Is there a fix for CVE-2024-43800?: Yes. serve-static (npm): upgrade to 1.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-43800 attacked?: It is attacked over the network.
Am I affected by CVE-2024-43800?: Check whether you run serve-static (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

serve-static (npm): upgrade to 1.16.0 or later
```
npm install serve-static@1.16.0
```

Technical details

The vulnerability is a template injection (CWE-79: Cross-site Scripting) in the serve-static middleware's redirect() function. When untrusted user input is passed to response.redirect() without proper validation, it can be injected into a server-side template, leading to arbitrary code execution. The attack requires the attacker to control the redirect parameter, the server to delay the redirect response, the browser to not immediately redirect away, and explicit user interaction (clicking a link). The vulnerability affects serve-static versions before 1.16.0 and versions 2.0.0 through 2.0.x before 2.1.0. Patches are available in serve-static 1.16.0 and 2.1.0.

Affected products

Express.js serve-static < 1.16.0, >= 2.0.0 < 2.1.0

Identifiers

CVE-2024-43800
GHSA-cm22-4g7w-348p

Timeline

2024-09-10: disclosed
2024-09-10: patched: Fixed in serve-static 1.16.0 and 2.1.0

References

https://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.