PT-2024-23117 · Unknown · Astro-Shield

Castarco · Published 2024-03-28 · Updated 2024-03-29 · CVE-2024-29896

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Astro-Shield versions prior to 1.3.0

Description Astro-Shield is a library used to compute subresource integrity hashes for JavaScript scripts and CSS stylesheets. When automated Content Security Policy (CSP) headers generation for Server-Side Rendering (SSR) content is enabled and the web application serves content that can be partially controlled by external users, there is a possibility that the CSP headers generation feature might allow malicious injected resources, such as inlined JavaScript or references to external malicious scripts.

Recommendations For versions prior to 1.3.0, update to version 1.3.0 to resolve the issue. As a temporary workaround, consider disabling the automated CSP headers generation feature until a patch is available. Alternatively, use the CSP headers generation feature only for dynamically generated content that cannot be controlled by external users in any way.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2024-29896

GHSA-W387-5QQW-7G8M

Affected Products

Astro-Shield

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29896.json · Exploit
• https://github.com/KindSpells/astro-shield/security/advisories/GHSA-w387-5qqw-7g8m · Vendor Advisory
• https://github.com/KindSpells/astro-shield/commit/41b84576d37fa486a57005ea297658d0bc38566d · Patch
• https://osv.dev/vulnerability/GHSA-w387-5qqw-7g8m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29896 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29896 · Vendor Advisory
• https://github.com/KindSpells/astro-shield/compare/1.2.0...1.3.0 · Note
• https://github.com/KindSpells/astro-shield · Note
• https://github.com/KindSpells/astro-shield/commit/ad3abf5577bae9be420b7ddf376337a5b8817869 · Note
• https://t.me/cvenotify/74990 · Telegram Post
• https://twitter.com/CVEnew/status/1773341064151150709 · Twitter Post
• https://t.me/cvenotify/75009 · Telegram Post