Critical Vulnerability in Node-Send Package: Untrusted Input Execution Risk
Summary
DEBIAN-CVE-2024-43799: Send is a library for streaming files from the file system as a http response. Affects node-send versions < 0.17.1-2+deb11u1. Fixed in 0.17.1-2+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-Send is a library designed for streaming files from the file system as HTTP responses. It is widely used in web applications to facilitate file transfers. However, this package has a significant vulnerability that allows untrusted user input to be executed as code, posing a serious security risk to applications that rely on it.
Vulnerability Detail
The vulnerability arises from the way Node-Send handles untrusted user input passed to the SendStream.redirect() method. This flaw can lead to the execution of arbitrary code, potentially compromising the server and exposing sensitive data. The issue has been identified and patched in version 0.19.0 of the package, but earlier versions remain vulnerable.
How To Fix
Minimum fixed version
0.17.1-2+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-sendTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider sanitizing user input before passing it to SendStream.redirect() to mitigate the risk of code execution. Implement input validation and restrict the types of inputs accepted by the application.
Conclusion
The Node-Send package has a critical vulnerability that can lead to arbitrary code execution due to improper handling of untrusted user input. It is crucial to update to the patched versions to secure your applications. Implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for node-send →
FAQ
The vulnerability allows untrusted user input to be executed as code, which can lead to arbitrary code execution on the server.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing the manifest file. Visit Vulert Scanner to check your application without any signup.
All versions prior to 0.19.0 are affected, with specific fixed versions available for different Debian releases.
Implement input validation and sanitization as a temporary workaround to reduce the risk of exploitation.
Detailed information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-43799.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-send.
