CVE-2024-43799: send vulnerable to template injection that can lead to XSS
Impact
passing untrusted user input - even after sanitizing it - to SendStream.redirect() may execute untrusted code
Patches
this issue is patched in send 0.19.0
Workarounds
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
Details
successful exploitation of this vector requires the following:
1. The attacker MUST control the input to response.redirect() 1. express MUST NOT redirect before the template appears 1. the browser MUST NOT complete redirection before: 1. the user MUST click on the link in the template
Other sources
pillarjs send is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.
— NVD
send vulnerable to template injection that can lead to XSS
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43799?
CVE-2024-43799 is considered a moderate severity vulnerability due to the potential execution of untrusted code through user input.
How do I fix CVE-2024-43799?
To fix CVE-2024-43799, upgrade to version 0.19.0 or later of the 'send' package.
What causes CVE-2024-43799?
CVE-2024-43799 is caused by passing untrusted user input to the SendStream.redirect() function, which may lead to code execution.
Which versions of the 'send' package are affected by CVE-2024-43799?
CVE-2024-43799 affects all versions of the 'send' package before 0.19.0.
Is there a workaround for CVE-2024-43799 if I cannot upgrade?
If upgrading is not an option, ensure input is highly sanitized and thoroughly validated before being passed to SendStream.redirect().