CVE-2024-29041mediumCWE-1286CWE-601

CVE-2024-29041: medium-severity vulnerability in expressjs express

Express.js Open Redirect in malformed URLs

Published · Updated

Follow this CVE+ Monitor express+ Monitor express

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.8%
In short

Express.js versions before 4.19.2 have a flaw where malformed URLs can bypass redirect security filters, allowing attackers to redirect users to unintended external websites.

Technical detail

CWE-1286/CWE-601 open redirect vulnerability in Express.js res.location() and res.redirect() methods. Malformed URLs are processed by encodeurl in a way that bypasses allow list validation, enabling attackers to redirect authenticated users to attacker-controlled domains when the application accepts user-supplied redirect URLs.

Summary generated and translated by AI from the official description.
Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
expressjs · express
Related CVEs — expressjs express

In the same product, most dangerous first.

CVE-2024-43796MEDIUMexpress vulnerable to XSS via response.redirect()EPSS 0.5%CVE-2024-9266MEDIUMOpen RedirectEPSS 0.5%