Critical Code Execution Vulnerability in Node-Send Package
Summary
CVE-2024-43799: Send is a library for streaming files from the file system as a http response. Affects node-send across 2 version ranges.
< 0.17.1-2+deb11u1
< ae4f2989491b392ae2ef3b0015a019770ae65d35
Fixed in 0.17.1-2+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-Send is a popular library used for streaming files from the file system as HTTP responses. It is widely utilized in web applications to facilitate file transfers efficiently. However, due to its reliance on user input for file redirection, it has become susceptible to vulnerabilities that can lead to code execution if not properly managed.
Vulnerability Detail
The vulnerability identified as CVE-2024-43799 arises from the Send library's handling of untrusted user input passed to the SendStream.redirect() function. This flaw allows attackers to execute arbitrary code by manipulating the input, potentially leading to severe consequences such as unauthorized access to sensitive data or system compromise. The issue has been patched in version 0.19.0 of the Send library, but prior versions remain at risk.
How To Fix
Minimum fixed version
0.17.1-2+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-sendTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to validate and sanitize all user inputs before passing them to the SendStream.redirect() function. This can be achieved by implementing input validation logic in your application code to restrict the types of inputs accepted.
Conclusion
The CVE-2024-43799 vulnerability in the Node-Send package poses a significant risk due to its potential for arbitrary code execution. It is crucial for users to upgrade to the patched version 0.19.0 or later to ensure the security of their applications. Implementing input validation can serve as a temporary measure while preparing for the upgrade.
See every vulnerability recorded for node-send →
FAQ
CVE-2024-43799 is a vulnerability in the Node-Send package that allows for arbitrary code execution due to improper handling of untrusted user input.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Not addressing this vulnerability can lead to severe security risks, including unauthorized access to sensitive data and potential system compromise.
Yes, you should upgrade to version 0.19.0 or later of the Node-Send package to mitigate this vulnerability.
If you cannot upgrade right away, implement input validation and sanitization as a temporary workaround to reduce the risk.
Related vulnerabilities
Recent vulnerabilities recorded for node-send.
