Headline
GHSA-cm22-4g7w-348p: serve-static vulnerable to template injection that can lead to XSS
Impact
passing untrusted user input - even after sanitizing it - to redirect()
may execute untrusted code
Patches
this issue is patched in serve-static 1.16.0
Workarounds
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
Details
successful exploitation of this vector requires the following:
- The attacker MUST control the input to response.redirect()
- express MUST NOT redirect before the template appears
- the browser MUST NOT complete redirection before:
- the user MUST click on the link in the template
Skip to content
Navigation Menu
Actions
Automate any workflow
Packages
Host and manage packages
Security
Find and fix vulnerabilities
Codespaces
Instant dev environments
GitHub Copilot
Write better code with AI
Code review
Manage code changes
Issues
Plan and track work
Discussions
Collaborate outside of code
Explore
- Learning Pathways
- White papers, Ebooks, Webinars
- Customer Stories
- Partners
GitHub Sponsors
Fund open source developers
* The ReadME Project
GitHub community articles
Enterprise platform
AI-powered developer platform
- Pricing
Provide feedback
Saved searches****Use saved searches to filter your results more quickly
Sign up
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2024-43800
serve-static vulnerable to template injection that can lead to XSS
Moderate severity GitHub Reviewed Published Sep 10, 2024 in expressjs/serve-static • Updated Sep 10, 2024
Package
npm serve-static (npm)
Affected versions
< 1.16.0
>= 2.0.0, < 2.1.0
Patched versions
1.16.0
2.1.0
Description
Impact
passing untrusted user input - even after sanitizing it - to redirect() may execute untrusted code
Patches
this issue is patched in serve-static 1.16.0
Workarounds
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
Details
successful exploitation of this vector requires the following:
- The attacker MUST control the input to response.redirect()
- express MUST NOT redirect before the template appears
- the browser MUST NOT complete redirection before:
- the user MUST click on the link in the template
References
- GHSA-cm22-4g7w-348p
- https://nvd.nist.gov/vuln/detail/CVE-2024-43800
- expressjs/serve-static@0c11fad
- expressjs/serve-static@ce73089
Published to the GitHub Advisory Database
Sep 10, 2024
Last updated
Sep 10, 2024
Related news
Red Hat Security Advisory 2024-8014-03 - Network Observability 1.7 for Red Hat OpenShift. Issues addressed include code execution, cross site scripting, and denial of service vulnerabilities.
Red Hat Security Advisory 2024-7726-03 - Red Hat OpenShift Service Mesh Containers for 2.6.2. Issues addressed include code execution and denial of service vulnerabilities.
Red Hat Security Advisory 2024-7725-03 - Red Hat OpenShift Service Mesh Containers for 2.5.5. Issues addressed include code execution and denial of service vulnerabilities.
Red Hat Security Advisory 2024-7724-03 - Red Hat OpenShift Service Mesh Containers for 2.4.11. Issues addressed include a code execution vulnerability.