CVE-2024-43800: Openjsf Serve-static RCE Vulnerability

CVE-2024-43800 Overview

CVE-2024-43800 affects serve-static, a widely used Node.js middleware for serving static files. The vulnerability allows attackers to inject executable content through the redirect() function. The library passes untrusted user input to redirect() even after sanitization, enabling reflected cross-site scripting (XSS) [CWE-79]. Successful exploitation requires user interaction, such as clicking a crafted link. The issue is patched in serve-static version 1.16.0.

Critical Impact
Attackers can execute arbitrary script content in a victim's browser context, leading to session theft, credential harvesting, and unauthorized actions against applications relying on serve-static.

Affected Products

openjsf:serve-static versions prior to 1.16.0
Node.js applications using vulnerable serve-static middleware
Express.js applications embedding vulnerable serve-static releases

Discovery Timeline

2024-09-10 - CVE-2024-43800 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43800

Vulnerability Analysis

The vulnerability resides in the redirect response handler of serve-static. When the middleware receives a request for a directory without a trailing slash, it generates an HTML redirect document containing the requested URL. The library encodes the URL and applies escapeHtml(), but the resulting value is embedded inside an href attribute in an anchor tag. Attackers can craft input that survives sanitization and breaks out of the attribute context, injecting script-executable markup rendered by the victim's browser.

Exploitation requires a user to visit a crafted link, and the attack complexity is elevated because payloads must survive URL parsing and HTML escaping. The scope change reflects that injected content executes in the origin serving the static files, not the attacker's origin.

Root Cause

The root cause is unsafe construction of HTML output in the redirect path. Even after escapeHtml() processing, embedding user-controlled data inside an anchor href attribute leaves an injection surface when combined with URL formatting quirks. The fix removes the anchor tag entirely, producing a plain text redirect message that cannot be leveraged for script execution.

Attack Vector

An attacker crafts a URL targeting a directory path served by the vulnerable application. The URL contains characters designed to escape the href context after encoding and HTML escaping. When a victim clicks the link, the server returns a 301 redirect page containing the malicious markup, and the browser renders the payload before following the redirect.

javascript

// Security patch in serve-static index.js
// reformat the URL
var loc = encodeUrl(url.format(originalUrl))
- var doc = createHtmlDocument('Redirecting', 'Redirecting to <a href="' + escapeHtml(loc) + '">' +
-   escapeHtml(loc) + '</a>')
+ var doc = createHtmlDocument('Redirecting', 'Redirecting to ' + escapeHtml(loc))

// send redirect response
res.statusCode = 301

Source: GitHub Commit 0c11fad

Detection Methods for CVE-2024-43800

Indicators of Compromise

HTTP requests to directory paths containing encoded quote characters, angle brackets, or javascript: URI fragments in the path segment.
HTTP 301 responses whose body contains anchor tags with attacker-influenced href values.
Client-side error telemetry showing unexpected script execution originating from static file endpoints.

Detection Strategies

Inspect access logs for anomalous URL patterns targeting directories served by serve-static, especially requests missing trailing slashes with suspicious characters.
Deploy a web application firewall (WAF) signature that flags XSS payloads in URL path segments preceding a 301 redirect.
Perform software composition analysis (SCA) on Node.js dependency trees to identify serve-static versions below 1.16.0.

Monitoring Recommendations

Alert on outbound requests from user browsers to unfamiliar domains immediately after visits to static file directories.
Track dependency version drift in continuous integration pipelines and fail builds that pin vulnerable serve-static releases.
Correlate 301 responses with subsequent authentication anomalies to identify potential session theft.

How to Mitigate CVE-2024-43800

Immediate Actions Required

Upgrade serve-static to version 1.16.0 or later across all Node.js applications.
Audit transitive dependencies, including Express.js versions, that bundle vulnerable serve-static releases.
Rebuild and redeploy container images and serverless functions that ship the vulnerable middleware.

Patch Information

The fix landed in commits 0c11fad and ce73089. See the GitHub Security Advisory GHSA-cm22-4g7w-348p for full details. Upgrading to serve-static 1.16.0 removes the vulnerable HTML anchor construction.

Workarounds

Configure a reverse proxy or WAF to strip or reject requests containing HTML metacharacters in URL path segments.
Enforce a strict Content-Security-Policy (CSP) header that blocks inline script execution on static file endpoints.
Disable directory redirect behavior by ensuring all directory requests include trailing slashes at the proxy layer.

bash

# Upgrade serve-static to the patched version
npm install serve-static@^1.16.0

# Verify installed version across the dependency tree
npm ls serve-static

# Audit for known vulnerabilities after upgrade
npm audit --production