Express 4.13.4 Vulnerabilities: CVE-2016-10539 & CVE-2017-16119

This article discusses two high-severity vulnerabilities found in the express-4.13.4.tgz library. These vulnerabilities, CVE-2016-10539 and CVE-2017-16119, have a CVSS score of 7.5 and require immediate attention to ensure the security of your applications. This comprehensive guide provides a detailed overview of each vulnerability, including their causes, potential impact, and recommended remediation steps. Addressing these vulnerabilities is crucial for maintaining the integrity and security of your applications that rely on the Express.js framework.

Vulnerable Library: express-4.13.4.tgz

Express is a fast, unopinionated, minimalist web framework for Node.js. While it provides a solid foundation for building web applications and APIs, older versions like 4.13.4 may contain security vulnerabilities that can be exploited by malicious actors. Identifying and addressing these vulnerabilities is paramount to safeguarding your application and user data.

• Path to dependency file: /package.json
• Path to vulnerable library: /node_modules/express/package.json

Findings

The following table summarizes the vulnerabilities found in the express-4.13.4.tgz library:

Details of Vulnerabilities

🔴 CVE-2016-10539

Vulnerable Library - negotiator-0.5.3.tgz

The CVE-2016-10539 vulnerability resides in the negotiator-0.5.3.tgz library, a transitive dependency of Express. This library is responsible for HTTP content negotiation, a process where the server and client agree on the best format for exchanging data. However, versions 0.6.0 and earlier of negotiator are susceptible to Regular Expression Denial of Service (ReDoS) attacks. This vulnerability is triggered when parsing the Accept-Language header with a specially crafted string, which can cause the application to become unresponsive. To mitigate this risk, it's crucial to update the negotiator library or upgrade Express to a version that includes the fix.

• Library home page: https://registry.npmjs.org/negotiator/-/negotiator-0.5.3.tgz
• Path to dependency file: /package.json
• Path to vulnerable library: /node_modules/negotiator/package.json
• Dependency Hierarchy:
  • express-4.13.4.tgz (Root Library)
    • accepts-1.2.13.tgz
      • ❌ negotiator-0.5.3.tgz (Vulnerable Library)

Vulnerability Details

negotiator is an HTTP content negotiator for Node.js, widely used by modules and frameworks like Express and Koa. The vulnerability lies in how it parses the Accept-Language header. A specially crafted string can cause a Regular Expression Denial of Service (ReDoS), potentially crashing the application or making it unresponsive due to excessive CPU usage. This can lead to a significant disruption of service, impacting user experience and potentially causing data loss.

• Publish Date: May 31, 2018 08:00 PM
• URL: CVE-2016-10539
• Threat Assessment
  • Exploit Maturity: Not Defined
  • EPSS: < 1%
• Score: 7.5

Suggested Fix

To address CVE-2016-10539, upgrade the negotiator library to version 0.6.1 or later. This version includes a fix that prevents the ReDoS attack. Alternatively, you can upgrade Express to version 4.14.0, which includes the updated negotiator library. Upgrading is the recommended approach to ensure your application is protected from this vulnerability.

• Type: Upgrade version
• Origin: https://www.npmjs.com/advisories/106
• Release Date: May 31, 2018 08:00 PM
• Fix Resolution (negotiator): 0.6.1
• Direct dependency fix Resolution (express): 4.14.0

🔴 CVE-2017-16119

Vulnerable Library - fresh-0.3.0.tgz

The CVE-2017-16119 vulnerability is found in the fresh-0.3.0.tgz library, another dependency of Express. This library is responsible for HTTP response freshness testing, which helps determine if a cached response is still valid. A regular expression denial of service vulnerability exists, where specially crafted input can cause the event loop to be blocked, leading to a denial-of-service condition. To resolve this, upgrading to a patched version of either fresh or Express is recommended.

• Library home page: https://registry.npmjs.org/fresh/-/fresh-0.3.0.tgz
• Path to dependency file: /package.json
• Path to vulnerable library: /node_modules/fresh/package.json
• Dependency Hierarchy:
  • express-4.13.4.tgz (Root Library)
    • ❌ fresh-0.3.0.tgz (Vulnerable Library)

Vulnerability Details

fresh is a module used by Express.js for HTTP response freshness testing. It's vulnerable to a regular expression denial of service (ReDoS) attack. When passed specially crafted input, the parsing process can block the event loop, resulting in a denial-of-service condition. This can severely impact application availability and performance, making it critical to address this vulnerability promptly.

• Publish Date: Jun 07, 2018 02:00 AM
• URL: CVE-2017-16119
• Threat Assessment
  • Exploit Maturity: Not Defined
  • EPSS: < 1%
• Score: 7.5

Suggested Fix

To remediate CVE-2017-16119, upgrade the fresh library to version 0.5.2 or later. Alternatively, upgrade Express to version 4.15.5, which includes the patched fresh library. By upgrading, you ensure that the regular expression parsing is handled securely, preventing the denial-of-service condition. Implementing this fix will improve the stability and security of your Express.js application.

• Type: Upgrade version
• Origin: https://www.npmjs.com/advisories/526
• Release Date: Jun 07, 2018 02:00 AM
• Fix Resolution (fresh): 0.5.2
• Direct dependency fix Resolution (express): 4.15.5

Conclusion

Addressing vulnerabilities like CVE-2016-10539 and CVE-2017-16119 in your Express.js applications is crucial for maintaining security and stability. By upgrading the affected libraries (negotiator and fresh) or upgrading Express itself, you can mitigate the risks associated with these vulnerabilities. Regularly monitoring your dependencies for known vulnerabilities and applying timely updates are essential practices for securing your applications. Remember to thoroughly test your applications after applying any updates to ensure compatibility and stability. These vulnerabilities highlight the importance of keeping your dependencies up-to-date and staying informed about potential security risks.

For more information on web application security, consider visiting the OWASP Foundation website: https://owasp.org/. Their resources can help you better understand and address common web security vulnerabilities.