CVE-2024-10491: Preload arbitrary resources by injecting additional `Link` headers
A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.
The issue arises from improper sanitization in Link header values, which can allow a combination of characters like ,, ;, and <> to preload malicious resources.
This vulnerability is especially relevant for dynamic parameters.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10491?
CVE-2024-10491 is classified as a moderate severity vulnerability due to its potential for arbitrary resource injection.
How do I fix CVE-2024-10491?
To fix CVE-2024-10491, update to Express version 4.0.0-rc1 or later to ensure proper sanitization of Link header values.
What versions of Express are affected by CVE-2024-10491?
CVE-2024-10491 affects all versions of Express up to and including 3.21.4.
What are the consequences of exploiting CVE-2024-10491?
Exploiting CVE-2024-10491 can lead to security risks such as arbitrary resource injection through unsanitized Link header values.
Is CVE-2024-10491 related to any specific programming languages?
CVE-2024-10491 is related to Node.js applications that utilize the Express framework.