Incorrect Authorization Affecting astro package, versions <7.2.4

astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind.

Affected versions of this package are vulnerable to Incorrect Authorization in BaseApp.removeBase, FetchState pathname stripping, and matchRequest in the routing and app base-handling code. An attacker can reach protected routes by sending a request whose pathname extends the configured base with a non-segment suffix, such as /appX/admin, causing routing to resolve the request as /admin while middleware still inspects the unstripped /appX/admin pathname. This lets an unauthenticated remote attacker bypass pathname-based middleware checks and access routes the application intended to protect under a non-root base.

Workarounds

• Reject requests whose pathname does not begin with the configured base followed by a path-segment boundary, so paths like /appX/admin, /app2/admin, or /app-/admin are not treated as being under /app and cannot bypass pathname-based middleware authorization.
• Do not rely solely on prefix checks of context.url.pathname for authorization when using a non-root base; enforce route access in a way that only permits the exact base path or paths under base/, preventing the router and middleware from disagreeing about whether a request is protected.

• GitHub Commit
• GitHub PR
• Maintainer's Advisory