Preload arbitrary resources by injecting additional `Link` headers

Vulnerability

Description A resource injection vulnerability exists in the Express response.links() function, allowing arbitrary injection into the Link header when unsanitized data is used [1]. The root cause is improper sanitization of Link header values, which can permit characters such as ,, ;, and <> to be used to inject malicious resources [3].

Attack

Vector The vulnerability is especially relevant for dynamic parameters where user input is directly passed to res.links() [1]. An attacker can craft a malicious query parameter containing characters like <> to inject arbitrary Link header values, as demonstrated in a proof-of-concept [3][4]. For example, a payload like ?resource=http://api.example.com/users?resource=>; rel="preload", <http://api.malicious.com/1.js>; rel="preload" can be used to preload external resources [3].

Impact

Successful exploitation allows an attacker to inject arbitrary resource links into the HTTP response header, potentially leading to resource injection attacks such as preloading malicious scripts or resources [1][3]. This could result in unintended resource loading or information disclosure.

Mitigation

The issue affects Express versions 3.0.0-alpha1 through 3.21.2 [3]. It has been fixed in Express NES v3.21.5 [3]. Users should upgrade to the patched version or sanitize user input before using it in res.links() to prevent injection [3].