Executive brief
Astro is a web framework that includes client-side routing through a ViewTransitions component. A vulnerability in this router allows attackers to inject specially-crafted HTML elements that hijack the script execution mechanism, enabling them to run arbitrary JavaScript code (XSS attacks) on pages that accept user-controlled HTML content without proper sanitization of element name attributes.
Technical details
The vulnerability is a DOM Clobbering attack targeting the runScripts() function in Astro's router.ts. The code iterates over document.scripts to re-execute scripts during page transitions, but this global can be shadowed by attacker-injected HTML elements (e.g., <iframe name="scripts">) via the browser's named access mechanism. Iteration over the shadowed property yields attacker-controlled elements instead of actual script tags, bypassing type checks and the astroExec dataset filter. The attacker's innerHTML is then assigned to a newly created script element, resulting in XSS execution. Attack requires: client-side routing enabled, ViewTransitions component in use, and a mechanism for the attacker to inject unsanitized scriptless HTML (user comments, markdown, third-party script injection). The fix replaces document.scripts with document.getElementsByTagName('script'), which is not vulnerable to shadowing. Patched in version 4.16.1.
Affected products
- Astro Astro >=3.0.0, <4.16.1
Timeline
- 2024-10-14: disclosed
- 2024-10-14: patched: Fixed in version 4.16.1