CVE-2024-29896
When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the CSP headers generation feature might be "allow-listing" malicious…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.59%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the CSP headers generation feature might be "allow-listing" malicious injected resources like inlined JS, or references to external malicious scripts. The fix is available in version 1.3.0.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 0.59% probability · 46th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74
- Affected
- kindspells/astro-shield
- Source
- security-advisories@github.com
References
- https://github.com/KindSpells/astro-shield/commit/41b84576d37fa486a57005ea297658d0bc38566dPatch
- https://github.com/KindSpells/astro-shield/security/advisories/GHSA-w387-5qqw-7g8mVendor Advisory
- https://github.com/KindSpells/astro-shield/commit/41b84576d37fa486a57005ea297658d0bc38566dPatch
- https://github.com/KindSpells/astro-shield/security/advisories/GHSA-w387-5qqw-7g8mVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.