In short
- CVE-2024-29896 is a HIGH (CVSS 7.5) vulnerability affecting astro-shield (kindspells), @kindspells/astro-shield.
- Chance of exploitation in the next 30 days (EPSS): 0.59%, higher than 48.4% of all vulnerabilities.
- Fix: update to 1.3.0 or later.
Description
Impact
When the following conditions are met:
- Automated CSP headers generation for SSR content is enabled
- The web application serves content that can be partially controlled by external users
Then it is possible that the CSP headers generation feature might be "allow-listing" malicious injected resources like inlined JS, or references to external malicious scripts.
Patches
Available in version 1.3.0 .
Workarounds
- Do not enable CSP headers generation.
- Use it only for dynamically generated content that cannot be controlled by external users in any way.
References
Are there any links users can visit to find out more?
NVD description
Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the CSP headers generation feature might be "allow-listing" malicious injected resources like inlined JS, or references to external malicious scripts. The fix is available in version 1.3.0.
More vulnerabilities in astro-shield
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free