Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7581-1 advisory.

    It was discovered that Express incorrectly handled certain URLs, leading to an open redirect attack. A     remote attacker could possibly use this issue to perform phishing attacks. (CVE-2024-29041)

    Adam Korcz discovered that Express did not properly sanitize certain inputs. A remote attacker could     possibly use this issue to perform cross site scripting. (CVE-2024-43796)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release     alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a     user of Express performs a redirect using a user-provided URL Express performs an encode [using     `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location`     header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list     implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented     allow list. The main method impacted is `res.location()` but this is also called from within     `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3. (CVE-2024-29041)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release
    alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a
    user of Express performs a redirect using a user-provided URL Express performs an encode [using
    `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location`
    header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list
    implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented
    allow list. The main method impacted is `res.location()` but this is also called from within
    `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3. (CVE-2024-29041)

The version of reaper installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-29041 advisory.

  - Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release     alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a     user of Express performs a redirect using a user-provided URL Express performs an encode [using     `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location`     header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list     implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented     allow list. The main method impacted is `res.location()` but this is also called from within     `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3. (CVE-2024-29041)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
240190	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : Express vulnerabilities (USN-7581-1)	Nessus	Ubuntu Local Security Checks	low
227633	Linux Distros Unpatched Vulnerability : CVE-2024-29041	Nessus	Misc.	medium
418929	SCA: security update for express (GHSA-rv95-896h-c2vc)	Tenable Cloud Security	SCA Checks	medium
418929	SCA: security update for express (GHSA-rv95-896h-c2vc)	Tenable Self-Hosted Container Security	SCA Checks	medium
201607	CBL Mariner 2.0 Security Update: reaper (CVE-2024-29041)	Nessus	MarinerOS Local Security Checks	medium

Detections

Analytics

CVE-2024-29041

medium

Tenable Plugins

low

medium

medium

medium

medium