CVE-2024-30250highCWE-345

CVE-2024-30250: high-severity vulnerability in kindspells astro-shield

In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists

Published · Updated

Follow this CVE+ Monitor astro-shield+ Monitor @kindspells/astro-shield

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.3%
Astro-Shield is an integration to enhance website security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques. Versions from 1.2.0 to 1.3.1 of Astro-Shield allow bypass to the allow-lists for cross-origin resources by introducing valid `integrity` attributes to the injected code. This implies that the injected SRI hash would be added to the generated CSP header, which would lead the browser to believe that the injected resource is legit. This vulnerability is patched in version 1.3.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
kindspells · astro-shield