Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS13Mzg3LTVxcXctN2c4bc4AA6dw

Content-Security-Policy header generation in middleware could be compromised by malicious injections

Impact

When the following conditions are met:

Automated CSP headers generation for SSR content is enabled
The web application serves content that can be partially controlled by external users

Then it is possible that the CSP headers generation feature might be "allow-listing" malicious injected resources like inlined JS, or references to external malicious scripts.

Patches

Available in version 1.3.0 .

Workarounds

Do not enable CSP headers generation.
Use it only for dynamically generated content that cannot be controlled by external users in any way.

References

Are there any links users can visit to find out more?

Permalink: https://github.com/advisories/GHSA-w387-5qqw-7g8m
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13Mzg3LTVxcXctN2c4bc4AA6dw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 month ago
Updated: about 1 month ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Identifiers: GHSA-w387-5qqw-7g8m, CVE-2024-29896
References:

Repository: https://github.com/KindSpells/astro-shield
Blast Radius: 1.0

Affected Packages

npm:@kindspells/astro-shield

Dependent packages: 0
Dependent repositories: 0
Downloads: 755 last month
Affected Version Ranges: = 1.2.0
Fixed in: 1.3.0
All affected versions: 1.2.0
All unaffected versions: 0.5.0, 0.5.1, 1.0.1, 1.1.0, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6