PT-2024-23298 · Unknown · Astro-Shield

Castarco · Published 2024-04-01 · Updated 2024-04-04 · CVE-2024-30250

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Astro-Shield versions 1.2.0 through 1.3.1

Description Astro-Shield is an integration to enhance website security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques. The issue allows bypass to the allow-lists for cross-origin resources by introducing valid integrity attributes to the injected code, which would lead the browser to believe that the injected resource is legit. To exploit this, an attacker needs to first inject code into the rendered pages by exploiting other potential vulnerabilities.

Recommendations For Astro-Shield versions 1.2.0 through 1.3.1, update to version 1.3.2 to patch the vulnerability. As a temporary workaround, consider not using the middleware functionality of Astro-Shield, or use it only for content that cannot be controlled in any way by external users.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2024-30250

GHSA-C4GR-Q97G-PPWC

Affected Products

Astro-Shield

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30250.json · Exploit
• https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc · Vendor Advisory
• https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f · Patch
• https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a · Patch
• https://osv.dev/vulnerability/CVE-2024-30250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-30250 · Security Note
• https://osv.dev/vulnerability/GHSA-c4gr-q97g-ppwc · Vendor Advisory
• https://github.com/kindspells/astro-shield/releases/tag/1.3.2 · Note
• https://github.com/kindspells/astro-shield · Note
• https://t.me/cvenotify/75740 · Telegram Post
• https://t.me/cvenotify/75758 · Telegram Post