Cross-site Request Forgery (CSRF) Affecting astro package, versions <4.16.17
Threat Intelligence
Exploit Maturity
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Cross-site Request Forgery (CSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-ASTRO-8535263
- published19 Dec 2024
- disclosed18 Dec 2024
- creditKageShiron
Introduced: 18 Dec 2024
NewCVE-2024-56140 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade astro to version 4.16.17 or higher.
Overview
astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind.
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) through the function createOriginCheckMiddleware due to improper validation of the content-type header
PoC
fetch('http://test.example.com', { method: 'POST', credentials: 'include' });
// Pattern 2.2 Blob object without type
fetch('https://test.example.com', {
method: 'POST',
credentials: 'include',
body: new Blob(['a=b'], {}),
});