PT-2024-36726 · Astro · Astro

Lilnasy · Published 2024-12-19 · Updated 2026-01-15 · CVE-2024-56159

Positive Technologies (AI Summary)

CVSS v4.0

7.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Astro versions v5.0.3 through v5.0.7 Astro versions 4.16.17 and earlier Astro versions 5.0.8 and earlier

Description A flaw exists in the build process of Astro, a web framework for content-driven websites, allowing unauthenticated users to access parts of the server source code. During the build process, sourcemap files for server code are moved to a publicly accessible folder. These files can be retrieved via an unauthorized HTTP GET request. While some server files are hashed, files related to the file system router in the src/pages directory are predictably named, such as dist/client/pages/index.astro.mjs.map for src/pages/index.astro. This issue is the root cause of issue #12703. The vulnerability affects all server-output projects on Astro 5 versions v5.0.3 through v5.0.7 with sourcemaps enabled, and all static-output projects built using Astro 4 versions 4.16.17 or older, or Astro 5 versions 5.0.8 or older, with sourcemaps enabled. The impact is limited to source code exposure, but this could potentially lead to the discovery of further vulnerabilities. The presence of unsafe code, such as regular expressions, could be exploited.

Recommendations Update to astro@5.0.8 or later for server-output projects. Update to astro@5.0.9 or later for static-output projects. Update to astro@4.16.18 or later for Astro 4 static-output projects.

Exploit

Fix

Weakness Enumeration

CWE-219

Related Identifiers

CVE-2024-56159

GHSA-49W6-73CW-CHJR

Affected Products

Astro

References · 16

• 🔥 https://github.com/withastro/astro/security/advisories/GHSA-49w6-73cw-chjr · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56159.json · Exploit
• https://osv.dev/vulnerability/GHSA-49w6-73cw-chjr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56159 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56159 · Vendor Advisory
• https://github.com/withastro/astro · Note
• https://github.com/withastro/astro/blob/176fe9f113fd912f9b61e848b00bbcfecd6d5c2c/packages/astro/src/core/build/static-build.ts#L139 · Note
• https://github.com/withastro/astro/issues/12703 · Note
• https://github.com/withastro/astro/commit/039d022b1bbaacf9ea83071d27affc5318e0e515 · Note
• https://github.com/withastro/astro/commit/c879f501ff01b1a3c577de776a1f7100d78f8dd5 · Note
• https://github.com/getsentry/sentry-javascript/blob/develop/packages/astro/src/integration/index.ts#L50 · Note
• https://t.me/cvenotify/105210 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/2011589189146722555 · Twitter Post
• https://twitter.com/CVEnew/status/1869822970211791245 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1869867776673820779 · Twitter Post