CVE-2014-6393: XSS
The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding.
Other sources
The following flaw was found in Express:
Vulnerable versions of express do not specify a charset field in the content-type heade while displaying 400 level response messages. The lack of enforcing user's browser to set correct charset, could be leveraged by an attacker to perform a cross-site scripting attack, using non-standard encodings, like UTF-7.
This flaw is fixed in version 3.11 and 4.5 of Express.
External References:
https://nodesecurity.io/advisories/express-no-charset-in-content-type-header
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-6393?
CVE-2014-6393 is considered a high severity vulnerability that may allow remote XSS attacks due to improper handling of the Content-Type header.
How do I fix CVE-2014-6393?
To fix CVE-2014-6393, upgrade the Express framework to version 3.11 or 4.5 or later.
Which versions of Express are affected by CVE-2014-6393?
CVE-2014-6393 affects Express versions prior to 3.11 and any version before 4.5.
Can CVE-2014-6393 lead to successful XSS attacks?
Yes, CVE-2014-6393 can allow attackers to conduct XSS attacks through non-standard encoding if exploited.
Is CVE-2014-6393 specific to Node.js applications?
Yes, CVE-2014-6393 specifically affects the Express web framework used in Node.js applications.