Описание
Cross-Site Scripting (XSS) in restify
Affected versions of restify are susceptible to a cross-site scripting vulnerability when using URL encoded script tags in a non-existent URL.
Proof of Concept:
Request
https://localhost:3000/no5_such3_file7.pl?%22%3E%3Cscript%3Ealert(73541);%3C/script%3E
Will be included in response:
<script>alert(73541);</script>
Recommendation
Update to version 4.1.0 or later.
Пакеты
Наименование
restify
npm
Затронутые версииВерсия исправления
>= 2.0.0, <= 4.0.4
4.1.0
Связанные уязвимости
CVSS3: 6.1
nvd
больше 7 лет назад
Restify is a framework for building REST APIs. Restify >=2.0.0 <=4.0.4 using URL encoded script tags in a non-existent URL, an attacker can get script to run in some browsers.