CVE-2024-30250 - Vulnerability Details - OpenCVE

Astro-Shield is an integration to enhance website security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques. Versions from 1.2.0 to 1.3.1 of Astro-Shield allow bypass to the allow-lists for cross-origin resources by introducing valid `integrity` attributes to the injected code. This implies that the injected SRI hash would be added to the generated CSP header, which would lead the browser to believe that the injected resource is legit. This vulnerability is patched in version 1.3.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a
https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f
https://github.com/kindspells/astro-shield/releases/tag/1.3.2
https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-04-04T14:57:51.671Z

Updated: 2024-08-02T01:32:05.408Z

Reserved: 2024-03-26T12:52:00.933Z

Link: CVE-2024-30250

Vulnrichment

Updated: 2024-08-02T01:32:05.408Z

NVD

Status : Awaiting Analysis

Published: 2024-04-04T15:15:39.240

Modified: 2024-11-21T09:11:32.493

Link: CVE-2024-30250

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-30250", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-26T12:52:00.933Z", "datePublished": "2024-04-04T14:57:51.671Z", "dateUpdated": "2024-08-02T01:32:05.408Z"}, "containers": {"cna": {"title": "In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists", "problemTypes": [{"descriptions": [{"cweId": "CWE-345", "lang": "en", "description": "CWE-345: Insufficient Verification of Data Authenticity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc"}, {"name": "https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a", "tags": ["x_refsource_MISC"], "url": "https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a"}, {"name": "https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f", "tags": ["x_refsource_MISC"], "url": "https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f"}, {"name": "https://github.com/kindspells/astro-shield/releases/tag/1.3.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/kindspells/astro-shield/releases/tag/1.3.2"}], "affected": [{"vendor": "kindspells", "product": "astro-shield", "versions": [{"version": ">= 1.2.0, < 1.3.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-04T14:57:51.671Z"}, "descriptions": [{"lang": "en", "value": "Astro-Shield is an integration to enhance website security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques. Versions from 1.2.0 to 1.3.1 of Astro-Shield allow bypass to the allow-lists for cross-origin resources by introducing valid `integrity` attributes to the injected code. This implies that the injected SRI hash would be added to the generated CSP header, which would lead the browser to believe that the injected resource is legit. This vulnerability is patched in version 1.3.2."}], "source": {"advisory": "GHSA-c4gr-q97g-ppwc", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "kindspells", "product": "astro-shield", "cpes": ["cpe:2.3:a:kindspells:astro-shield:1.2.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1.2.0", "status": "affected", "lessThan": "1.3.2", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-04-05T17:38:23.724265Z", "id": "CVE-2024-30250", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-20T15:09:34.569Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:32:05.408Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc"}, {"name": "https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a"}, {"name": "https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f"}, {"name": "https://github.com/kindspells/astro-shield/releases/tag/1.3.2", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/kindspells/astro-shield/releases/tag/1.3.2"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc", "name": "https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a", "name": "https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f", "name": "https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/kindspells/astro-shield/releases/tag/1.3.2", "name": "https://github.com/kindspells/astro-shield/releases/tag/1.3.2", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:32:05.408Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-30250", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-05T17:38:23.724265Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:kindspells:astro-shield:1.2.0:*:*:*:*:*:*:*"], "vendor": "kindspells", "product": "astro-shield", "versions": [{"status": "affected", "version": "1.2.0", "lessThan": "1.3.2", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-20T15:08:35.673Z"}}], "cna": {"title": "In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists", "source": {"advisory": "GHSA-c4gr-q97g-ppwc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "kindspells", "product": "astro-shield", "versions": [{"status": "affected", "version": ">= 1.2.0, < 1.3.2"}]}], "references": [{"url": "https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc", "name": "https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a", "name": "https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f", "name": "https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/kindspells/astro-shield/releases/tag/1.3.2", "name": "https://github.com/kindspells/astro-shield/releases/tag/1.3.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Astro-Shield is an integration to enhance website security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques. Versions from 1.2.0 to 1.3.1 of Astro-Shield allow bypass to the allow-lists for cross-origin resources by introducing valid `integrity` attributes to the injected code. This implies that the injected SRI hash would be added to the generated CSP header, which would lead the browser to believe that the injected resource is legit. This vulnerability is patched in version 1.3.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "CWE-345: Insufficient Verification of Data Authenticity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-04T14:57:51.671Z"}}}, "cveMetadata": {"cveId": "CVE-2024-30250", "state": "PUBLISHED", "dateUpdated": "2024-08-02T01:32:05.408Z", "dateReserved": "2024-03-26T12:52:00.933Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-04-04T14:57:51.671Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "Astro-Shield is an integration to enhance website security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques. Versions from 1.2.0 to 1.3.1 of Astro-Shield allow bypass to the allow-lists for cross-origin resources by introducing valid `integrity` attributes to the injected code. This implies that the injected SRI hash would be added to the generated CSP header, which would lead the browser to believe that the injected resource is legit. This vulnerability is patched in version 1.3.2."}, {"lang": "es", "value": "Astro-Shield es una integraci\u00f3n para mejorar la seguridad del sitio web con hashes de integridad de subrecursos, encabezados de pol\u00edtica de seguridad de contenido y otras t\u00e9cnicas. Las versiones de 1.2.0 a 1.3.1 de Astro-Shield permiten eludir las listas permitidas para recursos de origen cruzado al introducir atributos de \"integridad\" v\u00e1lidos en el c\u00f3digo inyectado. Esto implica que el hash SRI inyectado se agregar\u00eda al encabezado CSP generado, lo que llevar\u00eda al navegador a creer que el recurso inyectado es leg\u00edtimo. Esta vulnerabilidad est\u00e1 parcheada en la versi\u00f3n 1.3.2."}], "id": "CVE-2024-30250", "lastModified": "2024-11-21T09:11:32.493", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-04-04T15:15:39.240", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a"}, {"source": "security-advisories@github.com", "url": "https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f"}, {"source": "security-advisories@github.com", "url": "https://github.com/kindspells/astro-shield/releases/tag/1.3.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/kindspells/astro-shield/releases/tag/1.3.2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}], "source": "security-advisories@github.com", "type": "Secondary"}]}