CVE-2024-10491

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources. This vulnerability is especially relevant for dynamic parameters.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.herodevs.com/vulnerability-directory/cve-2024-10491	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openjsf:express:*:*:*:*:*:node.js:*:*

History

06 Nov 2024, 23:08

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~4.0~~	v2 : unknown v3 : 5.3
References	~~() https://www.herodevs.com/vulnerability-directory/cve-2024-10491 -~~	() https://www.herodevs.com/vulnerability-directory/cve-2024-10491 - Exploit, Third Party Advisory
CPE		cpe:2.3:a:openjsf:express::::::node.js::*
CWE		NVD-CWE-noinfo
First Time		Openjsf Openjsf express

01 Nov 2024, 12:57

Type	Values Removed	Values Added
Summary		(es) Se ha identificado una vulnerabilidad en la función response.links de Express, que permite la inyección arbitraria de recursos en el encabezado Link cuando se utilizan datos no desinfectados. El problema surge de una desinfección incorrecta en los valores del encabezado `Link`, que puede permitir una combinación de caracteres como `,`, `;` y `<>` para precargar recursos maliciosos. Esta vulnerabilidad es especialmente relevante para los parámetros dinámicos.

29 Oct 2024, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-10-29 17:15

Updated : 2024-11-06 23:08

NVD link : CVE-2024-10491

Mitre link : CVE-2024-10491

CVE.ORG link : CVE-2024-10491

JSON object : View

Products Affected

openjsf

express

CWE

NVD-CWE-noinfo CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

{"id": "CVE-2024-10491", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "36c7be3b-2937-45df-85ea-ca7133ea542c", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "published": "2024-10-29T17:15:03.853", "references": [{"url": "https://www.herodevs.com/vulnerability-directory/cve-2024-10491", "tags": ["Exploit", "Third Party Advisory"], "source": "36c7be3b-2937-45df-85ea-ca7133ea542c"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "36c7be3b-2937-45df-85ea-ca7133ea542c", "description": [{"lang": "en", "value": "CWE-74"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in the Express response.links\u00a0function, allowing for arbitrary resource injection in the Link\u00a0header when unsanitized data is used.\n\nThe issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources.\n\nThis vulnerability is especially relevant for dynamic parameters."}, {"lang": "es", "value": " Se ha identificado una vulnerabilidad en la funci\u00f3n response.links de Express, que permite la inyecci\u00f3n arbitraria de recursos en el encabezado Link cuando se utilizan datos no desinfectados. El problema surge de una desinfecci\u00f3n incorrecta en los valores del encabezado `Link`, que puede permitir una combinaci\u00f3n de caracteres como `,`, `;` y `<>` para precargar recursos maliciosos. Esta vulnerabilidad es especialmente relevante para los par\u00e1metros din\u00e1micos."}], "lastModified": "2024-11-06T23:08:49.780", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openjsf:express:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "E54423CE-0344-49DB-9BAF-7DA1041AC966", "versionEndIncluding": "3.21.4"}], "operator": "OR"}]}], "sourceIdentifier": "36c7be3b-2937-45df-85ea-ca7133ea542c"}