CVE-2024-29896: Astro-Shield's Content-Security-Policy header generation in middleware could be compromised by malicious injections
Impact
When the following conditions are met: - Automated CSP headers generation for SSR content is enabled - The web application serves content that can be partially controlled by external users
Then it is possible that the CSP headers generation feature might be "allow-listing" malicious injected resources like inlined JS, or references to external malicious scripts.
Patches Available in version 1.3.0 .
Workarounds - Do not enable CSP headers generation. - Use it only for dynamically generated content that cannot be controlled by external users in any way.
References Are there any links users can visit to find out more?
Other sources
Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the CSP headers generation feature might be "allow-listing" malicious injected resources like inlined JS, or references to external malicious scripts. The fix is available in version 1.3.0.
— NVD
Node.js npm Astro-Shield module is vulnerable to script injection, caused by an error when automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users. A remote attacker could exploit this vulnerability to "allow-listing" malicious injected resources like inlined JS, or references to external malicious scripts by the CSP headers generation feature.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29896?
The severity of CVE-2024-29896 is currently under evaluation based on its impact and exploitability.
How do I fix CVE-2024-29896?
To fix CVE-2024-29896, ensure that you update your installation of @kindspells/astro-shield to version 1.3.0 or later, or apply the necessary patches for affected versions of IBM Cognos Analytics.
Who is affected by CVE-2024-29896?
CVE-2024-29896 affects users of the @kindspells/astro-shield package version 1.2.0 and earlier, as well as IBM Cognos Analytics versions up to 12.0.3 and 11.2.4 FP4.
What causes CVE-2024-29896?
CVE-2024-29896 is caused by automated CSP headers generation for SSR content being enabled in web applications that serve user-controllable content.
Is there a workaround for CVE-2024-29896?
Currently, the recommended approach is to update or patch the affected systems as there are no official workarounds available for CVE-2024-29896.