Executive brief
Astro is a web framework that provides built-in protection against cross-site request forgery (CSRF) attacks when the security.checkOrigin setting is enabled. A flaw in this protection allows attackers to bypass CSRF checks by crafting requests with malformed Content-Type headers or omitting the header entirely, potentially enabling unauthorized actions on behalf of authenticated users.
Technical details
The vulnerability exists in Astro's CSRF middleware which fails to properly validate requests when security.checkOrigin is true. The middleware incorrectly handles two attack patterns: (1) Content-Type headers with semicolon-delimited parameters (e.g., "application/x-www-form-urlencoded; abc") are treated as simple requests by browsers and bypass preflight validation, and (2) requests without a Content-Type header are not properly rejected. An attacker can craft a cross-origin POST request from a malicious site using either technique to execute unauthorized actions on a victim's authenticated session. The vulnerability requires user interaction (victim visiting the malicious site) and affects all Astro versions prior to 4.16.17, which includes the fix addressing both bypass patterns.
Affected products
- Astro Astro <4.16.17
Timeline
- 2024-12-18: disclosed
- 2024-12-18: patched: Fixed in version 4.16.17