PT-2024-30664 · Unknown+3 · Express.Js+3

Adamkorcz · Published 2024-09-10 · Updated 2025-12-19 · CVE-2024-43796

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Express.js versions prior to 4.20.0

Description The issue concerns the execution of untrusted code when passing untrusted user input to the response.redirect() function in Express.js, even after sanitizing the input. This can occur when an attacker controls the input to response.redirect(), Express.js does not redirect before the template appears, and the browser does not complete redirection before the user clicks on the link in the template.

Recommendations For Express.js versions prior to 4.20.0, upgrade to version 4.20.0 to patch the issue. As a temporary workaround, ensure any untrusted inputs are safe by validating them against an explicit allowlist before passing them to the response.redirect() function.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

AZL-49053

AZL-49091

AZL-49135

AZL-49152

CVE-2024-43796

GHSA-QW6H-VGH9-J6WX

USN-7581-1

Affected Products

Debian

Express.Js

Linuxmint

Ubuntu

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43796.json · Exploit
• https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx · Vendor Advisory
• https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553 · Patch
• https://ubuntu.com/security/CVE-2024-43796 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-43796 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-49135 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-43796 · Security Note
• https://osv.dev/vulnerability/AZL-49053 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7581-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qw6h-vgh9-j6wx · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7581-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43796 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-43796 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-43796 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2024-43796 · Vendor Advisory