PT-2024-5218 · Unknown+4 · Express.Js+4

Fdrag0N · Published 2024-03-25 · Updated 2026-04-05 · CVE-2024-29041

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Express.js versions prior to 4.19.0 Express.js pre-release alpha and beta versions of 5.0 prior to 5.0.0-beta.3

Description: The issue is related to an open redirect vulnerability using malformed URLs. When Express performs a redirect using a user-provided URL, it encodes the contents using encodeurl before passing it to the location header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is res.location() but this is also called from within res.redirect().

Recommendations: For Express.js versions prior to 4.19.0, update to version 4.19.2 or later. For Express.js pre-release alpha and beta versions of 5.0, update to version 5.0.0-beta.3 or later. As a temporary workaround, consider pre-parsing the URL string with either require('node:url').parse or new URL before passing the user input string to res.location or res.redirect.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-1286

CWE-601

Related Identifiers

AZL-37137

AZL-43690

AZL-44361

BDU:2024-05779

CVE-2024-29041

GHSA-RV95-896H-C2VC

USN-7581-1

Affected Products

Debian

Express.Js

Linuxmint

Red Os

Ubuntu

References · 35

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29041.json · Exploit
• https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd · Patch
• https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94 · Patch
• https://github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43690 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-37137 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rv95-896h-c2vc · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-29041 · Security Note
• https://ubuntu.com/security/CVE-2024-43796 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29041 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-29041 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7581-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2024-29041 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44361 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-29041 · Vendor Advisory