Executive brief
Express is a popular web application framework for Node.js used to build web APIs and servers. This vulnerability allows attackers to redirect users to untrusted external websites through manipulated Express redirect responses, potentially leading to phishing attacks or credential theft if users are tricked into following malicious links.
Technical details
This is a URL open redirect vulnerability (CWE-601) in the Express Response object's redirect handling logic. The vulnerability affects Express versions 3.4.5 through 4.0.0-rc1. An attacker can craft requests that cause the application to redirect users to arbitrary external URLs without proper validation. The attack requires user interaction (clicking a malicious link) but no authentication. The vulnerability is fixed in Express 4.0.0-rc1.
Affected products
- Express Express 3.4.5 through 4.0.0-rc1
Timeline
- 2024-10-03: disclosed: GHSA-jj78-5fmv-mv28 published
- 2024-10-03: patched: Fixed in Express 4.0.0-rc1