CVE-2024-43796: express vulnerable to XSS via response.redirect()
Impact
In express <4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code
Patches
this issue is patched in express 4.20.0
Workarounds
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
Details
successful exploitation of this vector requires the following:
1. The attacker MUST control the input to response.redirect() 1. express MUST NOT redirect before the template appears 1. the browser MUST NOT complete redirection before: 1. the user MUST click on the link in the template
Other sources
express vulnerable to XSS via response.redirect()
— Microsoft
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.
— NVD
expressjs express is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43796?
The severity of CVE-2024-43796 is considered high due to its potential to allow remote code execution through untrusted user input.
How do I fix CVE-2024-43796?
To fix CVE-2024-43796, upgrade to express version 4.20.0 or later.
Which versions of express are affected by CVE-2024-43796?
CVE-2024-43796 affects all versions of express up to and including 4.20.0.
Is there a workaround for CVE-2024-43796 if I can't upgrade?
There are no recommended workarounds for CVE-2024-43796 other than upgrading to the patched version of express.
What impact does CVE-2024-43796 have on my application?
CVE-2024-43796 could allow an attacker to execute arbitrary code in your application by leveraging improperly sanitized user input during redirects.