Executive brief
astro-shield is a middleware library that automatically generates Content-Security-Policy (CSP) headers for Astro web applications. When CSP header generation is enabled and a web application serves user-controlled content, an attacker can inject malicious code (such as inline JavaScript or references to external scripts) that the middleware will incorrectly allow-list in the CSP header, bypassing security protections and enabling script injection attacks.
Technical details
The vulnerability is a header injection issue (CWE-74) in the CSP header generation middleware of astro-shield versions 1.2.0. When automated CSP header generation for server-side rendered (SSR) content is enabled, the middleware fails to properly sanitize user-controlled content before incorporating it into the CSP header, allowing attackers to inject malicious directives or resource references. The attack requires that the web application serves partially user-controlled content and has CSP header generation enabled, but requires no authentication or user interaction. An attacker can exploit this to allow-list inline JavaScript or external malicious scripts, effectively bypassing the intended CSP protections. The vulnerability is fixed in version 1.3.0.
Affected products
- KindSpells astro-shield 1.2.0
Timeline
- 2024-03-27: disclosed
- 2024-03-29: patched: Fixed in version 1.3.0