CVE-2024-43796: XSS in Express.js

The vulnerability arises because Express.js, a popular Node.js web application framework, does not adequately sanitize user-controlled input before passing it to the response.redirect() function. An attacker who can control the input to response.redirect() can inject arbitrary JavaScript code. This code will then be executed in the context of the user's browser when the redirect occurs. Successful exploitation could allow an attacker to steal session cookies, redirect users to malicious websites, or modify the content of the page being displayed. The blast radius is significant, as any application using vulnerable versions of Express.js is potentially at risk. This is particularly concerning for applications that rely on user-supplied data for redirection purposes.

1. Reserved2024-08-16
2. Published2024-09-10
3. Modified2026-02-04
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-43796 is to upgrade to Express.js version 4.20.0 or later, which contains the fix. If upgrading is not immediately feasible, a workaround involves rigorously validating any user-supplied input before passing it to response.redirect(). Implement an explicit allowlist of acceptable characters or patterns to prevent malicious code injection. Consider using a web application firewall (WAF) with XSS filtering rules to provide an additional layer of defense. Regularly review and update input validation routines to ensure they remain effective against evolving attack techniques. After upgrade, confirm by attempting a redirect with a known malicious payload and verifying it is properly sanitized.

Last updated

5.2.15 months ago