CVE-2024-29041 Express.js Open Redirect in malformed URLs
Attackers can bypass redirect allow lists in Express.js applications using malformed URLs, leading to open redirects.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-29041?
CVE-2024-29041 is a medium-severity vulnerability in expressjs express, published on 25 Mar 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.
Which versions are affected by CVE-2024-29041?
4 open source packages ship an affected version, including express. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
express npm | All versions | 4.19.2 |
express npm | All versions | 4.19.2 |
express npm | From 5.0.0-alpha.1 | 5.0.0-beta.3 |
express npm | From 5.0.0-alpha.1 | 5.0.0-beta.3 |
Products include Openjsf Express.
How do I fix CVE-2024-29041?
Upgrade express to a fixed version for your release line: 4.19.2 or 5.0.0-beta.3.
Is CVE-2024-29041 being exploited?
There is no known exploitation of CVE-2024-29041 in the wild and no public exploit code.
Other vulnerabilities in expressjs express
Sources
Also known as AZL-37137, AZL-43690, AZL-44361, CLSA-2026-1792597402, DEBIAN-CVE-2024-29041, GHSA-rv95-896h-c2vc and 3 more.