Junglewise Threat Intelligence

CVE-2024-56159: Astro server source code exposure via enabled sourcemaps

CVE-2024-56159 · Severity: medium · CVSS 4 · Published 2024-12-19

Vendors: Astro.

Executive brief

Astro is a web framework that generates static or dynamically-rendered websites. When developers enable sourcemaps (which map compiled code back to original source for debugging), a bug in Astro's build process inadvertently exposes server-side source code to the public internet without authentication. An attacker can download these sourcemap files using simple HTTP requests and reconstruct the full server-side source code, potentially revealing business logic and enabling discovery of additional security vulnerabilities.

Technical details

This is a sensitive information disclosure vulnerability (CWE-219) affecting Astro's static build process. During the build phase, sourcemap files for server-side code (`.mjs.map` files) are copied to the same publicly-accessible folder (`dist/client`) as client-side assets such as CSS and fonts. For projects using file-system routing (pages in `src/pages`), these sourcemap files are predictably named (e.g., `dist/client/pages/index.astro.mjs.map`), allowing unauthenticated attackers to discover and download them via direct HTTP GET requests. The sourcemaps can be reconstructed to reveal full server source code using standard source-map visualization tools. Attack vector is network-based, requires no authentication or user interaction, and applies to: (1) Astro 5 server-output (SSR) projects v5.0.3–v5.0.6 with sourcemaps enabled, and (2) Astro 4 and 5 static-output (SSG) projects v4.16.17 and earlier (v5.0.7 and earlier) with sourcemaps enabled. Fixes released in astro@5.0.7 (SSR) and astro@5.0.8 (SSG) / astro@4.16.18 (SSG backport).

Affected products

  • Astro Astro 5.0.3 through 5.0.6 (SSR); 4.16.17 and earlier, 5.0.7 and earlier (SSG)

Timeline

  • 2024-12-19: disclosed
  • 2024-12-16: patched: Fix released in astro@5.0.8 (SSG) and astro@4.16.18 (SSG backport); astro@5.0.7 (SSR)

References