Astro - Information Disclosure

mediumseverity

5.3CVSS score

1.5%likelihood of exploitation, next 30 days

75%of all CVEs are less likely

Readycheck to confirm it

Astro versions v5.0.3 through v5.0.7 and Astro v4.16.17 or older with sourcemaps enabled contain a source code disclosure caused by sourcemap files being publicly accessible in the build output folder, letting unauthenticated users read server source code, exploit requires sourcemaps to be enabled.

Impact

Unauthenticated users can access server source code, potentially leading to discovery of further vulnerabilities or sensitive information.

Fix

Update Astro to version 5.0.8 or later for server-output projects, and to 5.0.9 or later (or 4.16.18 for Astro v4) for static-output projects with sourcemaps enabled.

How to confirm it

Send: GET {{BaseURL}}/pages/index.astro.mjs.map ; GET {{BaseURL}}/index.astro.mjs.map
Positive when: contains "\"version\":" and "\"sources\":" and "\"sourcesContent\":" and ".astro" AND status 200

Run it with nuclei: nuclei -id CVE-2024-56159 -u <target>

The full check

id: CVE-2024-56159

info:
  name: Astro - Information Disclosure
  author: theamanrawat
  severity: medium
  description: |
    Astro versions v5.0.3 through v5.0.7 and Astro v4.16.17 or older with sourcemaps enabled contain a source code disclosure caused by sourcemap files being publicly accessible in the build output folder, letting unauthenticated users read server source code, exploit requires sourcemaps to be enabled.
  impact: |
    Unauthenticated users can access server source code, potentially leading to discovery of further vulnerabilities or sensitive information.
  remediation: |
    Update Astro to version 5.0.8 or later for server-output projects, and to 5.0.9 or later (or 4.16.18 for Astro v4) for static-output projects with sourcemaps enabled.
  reference:
    - https://github.com/withastro/astro/security/advisories/GHSA-49w6-73cw-chjr
    - https://nvd.nist.gov/vuln/detail/CVE-2024-56159
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-56159
    epss-score: 0.01536
    epss-percentile: 0.75063
    cwe-id: CWE-219
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.html:"astro"
  tags: cve,cve2024,astro,sourcemap,exposure,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/pages/index.astro.mjs.map"
      - "{{BaseURL}}/index.astro.mjs.map"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"version":'
          - '"sources":'
          - '"sourcesContent":'
          - '.astro'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from