GHSA-qw3g-35hc-fcrhMediumCVSS 6.1

Cross-Site Scripting (XSS) in restify

Published
November 9, 2018
Last Modified
September 12, 2023

🔗 CVE IDs covered (1)

CVE-2017-16018 →

📋 Description

Affected versions of restify are susceptible to a cross-site scripting vulnerability when using URL encoded script tags in a non-existent URL.

Proof of Concept:

Request

https://localhost:3000/no5_such3_file7.pl?%22%3E%3Cscript%3Ealert(73541);%3C/script%3E

Will be included in response:

<script>alert(73541);</script>

Recommendation

Update to version 4.1.0 or later.

🎯 Affected products1

  • npm/restify:>= 2.0.0, <= 4.0.4

🔗 References (4)