-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| express | npm | < 4.19.2 | 4.19.2 |
| express | npm | >= 5.0.0-alpha.1, < 5.0.0-beta.3 | 5.0.0-beta.3 |
Miggo AIRoot Cause AnalysisThe analysis focused on the provided commit patches and the vulnerability description.
0867302ddbde0e9463d0564fea5861feb708c2dd directly modifies res.location in lib/response.js. The change from return this.set('Location', encodeUrl(loc)); to a more complex handling involving URL parsing and conditional encoding indicates that the original unconditional encoding of the entire URL was the source of the vulnerability. This function processes user-provided URLs and sets the Location header, making it central to the open redirect issue.0b746953c4bd8e377123527db11f9cd866e39f94 further refines the fix in res.location by changing how the URL is split and encoded (loc = loc.slice(0, pos) + encodeUrl(loc.slice(pos));). This new logic ensures that encodeUrl is only applied to the path and query parameters, not the scheme or host, preventing the bypass. This confirms that the encoding strategy within res.location was the core problem.res.location() but this is also called from within res.redirect().' This makes res.redirect an indirect but critical function in the context of this vulnerability, as it serves as an entry point to the flawed logic in res.location.
Both functions are part of lib/response.js in Express.js. The identified functions are those that either contained the flawed logic (res.location) or called the flawed logic with user-controlled input (res.redirect), and would thus appear in a runtime profile during exploitation.KEV Misses 88% of Exploited CVEs- Get the report