CVE-2024-10491 — Preload arbitrary resources by injecting additional `Link` headers

CVE-2024-10491

Preload arbitrary resources by injecting additional `Link` headers PUBLISHED

Description (CNA)

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources. This vulnerability is especially relevant for dynamic parameters.

Affected (CNA)

Vendor / product	Versions
express / express	affected 3.0.0-alpha1 through 3.21.2

CWE

CWE-74

References

https://www.herodevs.com/vulnerability-directory/cve-2024-10491

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.