Junglewise Threat Intelligence

CVE-2024-29896: KindSpells astro-shield CSP header injection vulnerability

CVE-2024-29896 · Severity: low · CVSS 3.1 · Published 2024-03-29

Vendors: npm.

Executive brief

astro-shield is a middleware library that automatically generates Content-Security-Policy (CSP) headers for Astro web applications. When CSP header generation is enabled and a web application serves user-controlled content, an attacker can inject malicious code (such as inline JavaScript or references to external scripts) that the middleware will incorrectly allow-list in the CSP header, bypassing security protections and enabling script injection attacks.

Technical details

The vulnerability is a header injection issue (CWE-74) in the CSP header generation middleware of astro-shield versions 1.2.0. When automated CSP header generation for server-side rendered (SSR) content is enabled, the middleware fails to properly sanitize user-controlled content before incorporating it into the CSP header, allowing attackers to inject malicious directives or resource references. The attack requires that the web application serves partially user-controlled content and has CSP header generation enabled, but requires no authentication or user interaction. An attacker can exploit this to allow-list inline JavaScript or external malicious scripts, effectively bypassing the intended CSP protections. The vulnerability is fixed in version 1.3.0.

Affected products

  • KindSpells astro-shield 1.2.0

Timeline

  • 2024-03-27: disclosed
  • 2024-03-29: patched: Fixed in version 1.3.0

References

Related threats