CVE-2024-30250: In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists
Impact
Versions from 1.2.0 to 1.3.1 of Astro-Shield allow to bypass the allow-lists for cross-origin resources by introducing valid integrity attributes to the injected code. This implies that the injected SRI hash would be added to the generated CSP header, which would lead the browser to believe that the injected resource is legit.
To exploit this vulnerability, the attacker needs to first inject code into the rendered pages by exploiting other not-related potential vulnerabilities.
Patches
Version 1.3.2 provides a patch.
Workarounds - To not use the middleware functionality of Astro-Shield. - To use the middleware functionality of Astro-Shield ONLY for content that cannot be controlled in any way by external users.
References Are there any links users can visit to find out more?
Other sources
Astro-Shield is an integration to enhance website security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques. Versions from 1.2.0 to 1.3.1 of Astro-Shield allow bypass to the allow-lists for cross-origin resources by introducing valid integrity attributes to the injected code. This implies that the injected SRI hash would be added to the generated CSP header, which would lead the browser to believe that the injected resource is legit. This vulnerability is patched in version 1.3.2.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-30250?
CVE-2024-30250 is considered a medium severity vulnerability due to its ability to bypass cross-origin resource allow-lists.
How do I fix CVE-2024-30250?
To fix CVE-2024-30250, upgrade Astro-Shield to version 1.3.2 or later.
What versions are affected by CVE-2024-30250?
CVE-2024-30250 affects Astro-Shield versions from 1.2.0 to 1.3.1.
What does CVE-2024-30250 exploit?
CVE-2024-30250 exploits the ability to introduce valid integrity attributes in order to manipulate cross-origin resource policies.
Is CVE-2024-30250 related to content security policies?
Yes, CVE-2024-30250 concerns the manipulation of content security policies via injected code.