PT-2024-30667 · Send+1 · Send+1

Adamkorcz · Published 2024-09-10 · Updated 2025-06-23 · CVE-2024-43799

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Send versions prior to 0.19.0

Description The issue arises from passing untrusted user input to SendStream.redirect(), which can execute untrusted code. This occurs even when the input is sanitized. The library Send is used for streaming files from the file system as an HTTP response.

Recommendations For versions prior to 0.19.0, update to version 0.19.0 to patch the issue. As a temporary workaround, ensure any untrusted inputs are safe by validating them against an explicit allowlist.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

AZL-49088

AZL-49123

AZL-49164

CVE-2024-43799

DLA-4224-1

GHSA-M6FV-JMCG-4JFG

Affected Products

Debian

Send

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43799.json · Exploit
• https://github.com/pillarjs/send/security/advisories/GHSA-m6fv-jmcg-4jfg · Vendor Advisory
• https://github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-43799 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-43799 · Security Note
• https://osv.dev/vulnerability/AZL-49164 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-43799 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-43799 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4224-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-49123 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-43799 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-43799 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m6fv-jmcg-4jfg · Vendor Advisory
• https://osv.dev/vulnerability/AZL-49088 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-43799 · Vendor Advisory