express vulnerable to XSS via response.redirect()

The vulnerability arises because Express.js, a popular Node.js web application framework, does not adequately sanitize user-controlled input before passing it to the response.redirect() function. An attacker who can control the input to response.redirect() can inject arbitrary JavaScript code. This code will then be executed in the context of the user's browser when the redirect occurs. Successful exploitation could allow an attacker to steal session cookies, redirect users to malicious websites, or modify the content of the page being displayed. The blast radius is significant, as any application using vulnerable versions of Express.js is potentially at risk. This is particularly concerning for applications that rely on user-supplied data for redirection purposes.

Web applications built using Express.js versions prior to 4.20.0 are at risk. This includes applications that handle user-supplied data and use response.redirect() for navigation or redirection purposes. Shared hosting environments where multiple applications share the same Express.js installation are particularly vulnerable, as a compromise in one application could potentially affect others.

• nodejs / server:

  npm list express

• nodejs / server:

  npm audit express

• generic web: Inspect application logs for unusual redirect patterns or error messages related to response.redirect(). • generic web: Review code for instances where user input is directly passed to response.redirect() without proper sanitization.

1. 2024-09-10Disclosure

   disclosure

1. Réservé2024-08-16
2. Publiée2024-09-10
3. Modifiée2026-02-04
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2024-43796 is to upgrade to Express.js version 4.20.0 or later, which contains the fix. If upgrading is not immediately feasible, a workaround involves rigorously validating any user-supplied input before passing it to response.redirect(). Implement an explicit allowlist of acceptable characters or patterns to prevent malicious code injection. Consider using a web application firewall (WAF) with XSS filtering rules to provide an additional layer of defense. Regularly review and update input validation routines to ensure they remain effective against evolving attack techniques. After upgrade, confirm by attempting a redirect with a known malicious payload and verifying it is properly sanitized.

Dernière mise à jour

5.2.1il y a 5 mois