CVE-2024-43799
published 2024-09-10CVE-2024-43799: Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes…
PriorityP422medium4.7CVSS 3.1
AVNACHPRNUIRSCCLILAN
EPSS
0.52%
40.0th percentile
Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-send | < node-send 0.18.0+~cs1.19.1-3+deb12u1 (bookworm) | node-send 0.18.0+~cs1.19.1-3+deb12u1 (bookworm) |
| msrc | azl3_python-tensorboard_2.16.2-6_on_azure_linux_3.0 | — | — |
| msrc | cbl2_reaper_3.1.1-13_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_reaper_3.1.1-18_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| pillarjs | send | < 0.19.0 | 0.19.0 |
| send_project | send | < 0.19.0 | 0.19.0 |
| send_project | send | >= 0 < 0.19.0 | 0.19.0 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
osv4.7MEDIUM
vendor_debian5.0MEDIUM
vendor_redhat5.0MEDIUM
vendor_msrc4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2024-43799: Send is a library for streaming files from the file system as a http response
osv·2024-09-10·CVSS 4.7
CVE-2024-43799 [MEDIUM] CVE-2024-43799: Send is a library for streaming files from the file system as a http response
Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.
GHSA
send vulnerable to template injection that can lead to XSS
ghsa·2024-09-10
CVE-2024-43799 [LOW] CWE-79 send vulnerable to template injection that can lead to XSS
send vulnerable to template injection that can lead to XSS
### Impact
passing untrusted user input - even after sanitizing it - to `SendStream.redirect()` may execute untrusted code
### Patches
this issue is patched in send 0.19.0
### Workarounds
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
### Details
successful exploitation of this vector requires the following:
1. The attacker MUST control the input to response.redirect()
1. express MUST NOT redirect before the template appears
1. the browser MUST NOT complete redirection before:
1. the user MUST click on the link in the template
OSV
send vulnerable to template injection that can lead to XSS
osv·2024-09-10
CVE-2024-43799 [LOW] send vulnerable to template injection that can lead to XSS
send vulnerable to template injection that can lead to XSS
### Impact
passing untrusted user input - even after sanitizing it - to `SendStream.redirect()` may execute untrusted code
### Patches
this issue is patched in send 0.19.0
### Workarounds
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
### Details
successful exploitation of this vector requires the following:
1. The attacker MUST control the input to response.redirect()
1. express MUST NOT redirect before the template appears
1. the browser MUST NOT complete redirection before:
1. the user MUST click on the link in the template
Microsoft
send vulnerable to template injection that can lead to XSS
vendor_msrc·2024-09-10·CVSS 4.7
CVE-2024-43799 [MEDIUM] CWE-79 send vulnerable to template injection that can lead to XSS
send vulnerable to template injection that can lead to XSS
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: http
Red Hat
send: Code Execution Vulnerability in Send Library
vendor_redhat·2024-09-10·CVSS 5.0
CVE-2024-43799 [MEDIUM] CWE-79 send: Code Execution Vulnerability in Send Library
send: Code Execution Vulnerability in Send Library
Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.
A flaw was found in the Send library. This vulnerability allows remote code execution via untrusted input passed to the SendStream.redirect() function.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Package: send (Cryostat 3) - Fix deferred
Package: openshift-logging/logging-view-plugin-rhel8 (Logging Subsystem for Red Hat OpenShift) - N
Debian
CVE-2024-43799: node-send - Send is a library for streaming files from the file system as a http response. S...
vendor_debian·2024·CVSS 5.0
CVE-2024-43799 [MEDIUM] CVE-2024-43799: node-send - Send is a library for streaming files from the file system as a http response. S...
Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.
Scope: local
bookworm: resolved (fixed in 0.18.0+~cs1.19.1-3+deb12u1)
bullseye: resolved (fixed in 0.17.1-2+deb11u1)
forky: resolved (fixed in 1.1.0+~cs1.19.4-1)
sid: resolved (fixed in 1.1.0+~cs1.19.4-1)
trixie: resolved (fixed in 1.1.0+~cs1.19.4-1)
No detection rules found.
No public exploits indexed.
2024-09-10
Published