CVE-2024-43800: medium-severity vulnerability in expressjs serve-static
serve-static affected by template injection that can lead to XSS
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in serve-static allows attackers to inject malicious code through specially crafted requests that bypass sanitization, potentially executing unauthorized scripts in users' browsers.
The vulnerability exists in the redirect() function's handling of user-supplied input; despite sanitization attempts, untrusted data can still be passed to redirect(), enabling template injection that leads to XSS execution. Attack vector is via HTTP requests with crafted redirect parameters; the vulnerability requires the attacker to control user input that reaches the redirect function. Impact includes arbitrary script execution in the context of the victim's browser session.