CVE-2024-29041: 
JavaScript vulnerability analysis and mitigation

Express.js versions prior to 4.19.2 and all pre-release alpha and beta versions before 5.0.0-beta.3 are affected by an open redirect vulnerability (CVE-2024-29041) using malformed URLs. The vulnerability occurs when Express performs a redirect using a user-provided URL, where the application encodes the URL using encodeurl before passing it to the location header. This encoding can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations, potentially leading to an open redirect vulnerability through bypass of properly implemented allow lists (GitHub Advisory).

The vulnerability primarily affects the res.location() method and by extension res.redirect(), which internally calls res.location(). When processing URLs containing special characters, the encoding process can result in the host portion of the URL being modified in a way that bypasses common URL validation checks. The issue has been assigned a CVSS v3.1 base score of 6.1 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating it requires user interaction but no privileges, and can affect resources beyond the vulnerable component's scope (GitHub Advisory).

The vulnerability can lead to open redirect attacks where malicious actors could bypass URL validation mechanisms and redirect users to untrusted sites, even when proper allow list implementations are in place. This could potentially be used in phishing attacks or other social engineering attempts to redirect users to malicious websites (GitHub Advisory).

The vulnerability has been patched in Express.js version 4.19.2 and 5.0.0-beta.3. As a workaround, developers can pre-parse the URL string using either require('node:url').parse or new URL() before passing the user input string to res.location or res.redirect. The fix was implemented in multiple stages, with an initial fix in version 4.19.0, a feature regression patch in 4.19.1, and improved handling for the bypass in 4.19.2 (GitHub Advisory).

The vulnerability has prompted multiple organizations to update their Express.js dependencies, as evidenced by security update advisories from Red Hat and other major projects. Several automated security tools and dependency managers have flagged this vulnerability for immediate attention (Red Hat Advisory).