Executive brief
Astro-Shield is a security middleware for the Astro web framework that enforces content security policies and allowlists for loaded resources. A vulnerability in versions 1.2.0–1.3.1 allows attackers to bypass these protections by adding a valid Subresource Integrity (SRI) hash attribute to injected malicious code, causing the browser to trust the injected resource. This requires the attacker to first inject code through another vulnerability, but once done, they can execute arbitrary cross-origin scripts that should have been blocked.
Technical details
The vulnerability is a Subresource Integrity (SRI) validation bypass in the Astro-Shield middleware. When code is injected into a page and includes a valid SRI integrity attribute, the middleware incorrectly adds that hash to the Content Security Policy header, causing the browser to trust the resource as legitimate. The root cause is improper handling of integrity attributes during CSP header generation. The attack requires a two-stage approach: first, the attacker exploits an unrelated injection vulnerability to inject code into rendered pages; second, they add an integrity attribute matching a valid hash, bypassing the allowlist. The vulnerability affects versions 1.2.0 through 1.3.1, and a patch is available in version 1.3.2. This is a critical control bypass affecting the integrity enforcement mechanism of the middleware.
Affected products
- kindspells astro-shield 1.2.0 through 1.3.1
Timeline
- 2024-03-31: disclosed
- 2024-04-01: patched: Version 1.3.2 released with fix