serve-static vulnerable to template injection that can lead to XSS

The core of the vulnerability lies in the improper handling of user-controlled input within the response.redirect() function. Even after sanitization, the input can still be exploited to trigger code execution within the context of the application. A successful attacker could inject malicious scripts that are then executed in the user's browser, potentially leading to session hijacking, data theft, or defacement of the web application. The requirement for the attacker to control the input and for express not to redirect before the template appears adds a layer of complexity, but doesn't negate the risk.

Applications utilizing the serve-static Node.js module, particularly those that dynamically generate redirects based on user-supplied data, are at risk. This includes web applications with user-controlled URL parameters or form inputs that are used in redirect operations. Shared hosting environments where developers may not have control over all dependencies are also at increased risk.

• nodejs / server:

  npm list serve-static

This command checks the installed version of serve-static in your project. If the version is less than 1.16.0, you are vulnerable. • nodejs / server:

  grep -r 'response.redirect(' . 

Search your codebase for instances of response.redirect() to identify potential vulnerable areas. Review the input validation logic surrounding these calls. • nodejs / server:

  find . -name 'package-lock.json' -exec grep serve-static/1.15.0 \;

This command searches for serve-static/1.15.0 in your package-lock.json file, indicating a vulnerable dependency.

1. 2024-09-10Disclosure

   disclosure

1. Reserviert2024-08-16
2. Veröffentlicht2024-09-10
3. Geändert2026-02-04
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-43800 is to upgrade to version 1.16.0 of the serve-static module. This patched version addresses the vulnerability by implementing proper input validation and sanitization. If upgrading is not immediately feasible, a workaround involves rigorously validating all user inputs against an explicit allowlist before passing them to response.redirect(). This ensures that only trusted data is used, preventing the injection of malicious scripts. Thorough testing of the application after implementing any workaround is crucial to confirm its effectiveness.

Zuletzt aktualisiert

2.2.1vor 5 Monaten