In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists
Impact
Versions from 1.2.0 to 1.3.1 of Astro-Shield allow to bypass the allow-lists for cross-origin resources by introducing valid integrity attributes to the injected code. This implies that the injected SRI hash would be added to the generated CSP header, which would lead the browser to believe that the injected resource is legit.
To exploit this vulnerability, the attacker needs to first inject code into the rendered pages by exploiting other not-related potential vulnerabilities.
Patches
Version 1.3.2 provides a patch.
Workarounds
- To not use the middleware functionality of Astro-Shield.
- To use the middleware functionality of Astro-Shield ONLY for content that cannot be controlled in any way by external users.
References
Are there any links users can visit to find out more?
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | @kindspells/astro-shield | >= 1.2.0, < 1.3.2 | 1.3.2 |
Referencias
- https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc
- https://nvd.nist.gov/vuln/detail/CVE-2024-30250
- https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a
- https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f
- https://github.com/kindspells/astro-shield
- https://github.com/kindspells/astro-shield/releases/tag/1.3.2
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N- Debilidad (CWE)
CWE-345- Plataforma
- npm
- Paquete
@kindspells/astro-shield- Publicada
- 01.04.2024
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-c4gr-q97g-ppwc - CC BY 4.0
Historial de vulnerabilidades: @kindspells/astro-shield
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 2
- Primera → última
- 03.2024 04.2024
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 2
Divulgaciones por año
- 2024: 2
- 2025: 0
- 2026: 0
-
In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.