Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. During build, along with client assets such as css and font files, the sourcemap files **for the server code** are moved to a publicly-accessible folder. Any outside party can read them with an unauthorized HTTP GET request to the same server hosting the rest of the website. While some server files are hashed, making their access obscure, the files corresponding to the file system router (those in `src/pages`) are predictably named. For example. the sourcemap file for `src/pages/index.astro` gets named `dist/client/pages/index.astro.mjs.map`. This vulnerability is the root cause of issue #12703, which links to a simple stackblitz project demonstrating the vulnerability. Upon build, notice the contents of the `dist/client` (referred to as `config.build.client` in astro code) folder. All astro servers make the folder in question accessible to the public internet without any authentication. It contains `.map` files corresponding to the code that runs on the server. All **server-output** projects on Astro 5 versions **v5.0.3** through **v5.0.7**, that have **sourcemaps enabled**, either directly or through an add-on such as `sentry`, are affected. The fix for **server-output** projects was released in **astro@5.0.8**. Additionally, all **static-output** projects built using Astro 4 versions **4.16.17 or older**, or Astro 5 versions **5.0.8 or older**, that have **sourcemaps enabled** are also affected. The fix for **static-output** projects was released in **astro@5.0.9**, and backported to Astro v4 in **astro@4.16.18**. The immediate impact is limited to source code. Any secrets or environment variables are not exposed unless they are present verbatim in the source code. There is no immediate loss of integrity within the the vulnerable server. However, it is possible to subsequently discover another vulnerability via the revealed source code . There is no immediate impact to availability of the vulnerable server. However, the presence of an unsafe regular expression, for example, can quickly be exploited to subsequently compromise the availability. The fix for **server-output** projects was released in **astro@5.0.8**, and the fix for **static-output** projects was released in **astro@5.0.9** and backported to Astro v4 in **astro@4.16.18**. Users are advised to update immediately if they are using sourcemaps or an integration that enables sourcemaps.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Astro is a web framework for content-driven websites. A bug in the build process allows any
    unauthenticated user to read parts of the server source code. During build, along with client assets such
    as css and font files, the sourcemap files **for the server code** are moved to a publicly-accessible
    folder. Any outside party can read them with an unauthorized HTTP GET request to the same server hosting
    the rest of the website. While some server files are hashed, making their access obscure, the files
    corresponding to the file system router (those in `src/pages`) are predictably named. For example. the
    sourcemap file for `src/pages/index.astro` gets named `dist/client/pages/index.astro.mjs.map`. This
    vulnerability is the root cause of issue #12703, which links to a simple stackblitz project demonstrating
    the vulnerability. Upon build, notice the contents of the `dist/client` (referred to as
    `config.build.client` in astro code) folder. All astro servers make the folder in question accessible to
    the public internet without any authentication. It contains `.map` files corresponding to the code that
    runs on the server. All **server-output** projects on Astro 5 versions **v5.0.3** through **v5.0.7**, that
    have **sourcemaps enabled**, either directly or through an add-on such as `sentry`, are affected. The fix
    for **server-output** projects was released in **astro@5.0.8**. Additionally, all **static-output**
    projects built using Astro 4 versions **4.16.17 or older**, or Astro 5 versions **5.0.8 or older**, that
    have **sourcemaps enabled** are also affected. The fix for **static-output** projects was released in
    **astro@5.0.9**, and backported to Astro v4 in **astro@4.16.18**. The immediate impact is limited to
    source code. Any secrets or environment variables are not exposed unless they are present verbatim in the
    source code. There is no immediate loss of integrity within the the vulnerable server. However, it is
    possible to subsequently discover another vulnerability via the revealed source code . There is no
    immediate impact to availability of the vulnerable server. However, the presence of an unsafe regular
    expression, for example, can quickly be exploited to subsequently compromise the availability. The fix for
    **server-output** projects was released in **astro@5.0.8**, and the fix for **static-output** projects was
    released in **astro@5.0.9** and backported to Astro v4 in **astro@4.16.18**. Users are advised to update
    immediately if they are using sourcemaps or an integration that enables sourcemaps. (CVE-2024-56159)

ID	Name	Product	Family	Type	Severity
410085	SCA: security update for astro (GHSA-49w6-73cw-chjr)	Tenable Cloud Security	SCA Checks	Local	high
410085	SCA: security update for astro (GHSA-49w6-73cw-chjr)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2024-56159

high

Tenable Plugins

high

high