CVE-2024-30250 json
In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists
published 2y ago modified 2mo ago also GHSA-c4gr-q97g-ppwc , EUVD-2024-1182
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
Astro-Shield is an integration to enhance website security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques. Versions from 1.2.0 to 1.3.1 of Astro-Shield allow bypass to the allow-lists for cross-origin resources by introducing valid `integrity` attributes to the injected code. This implies that the injected SRI hash would be added to the generated CSP header, which would lead the browser to believe that the injected resource is legit. This vulnerability is patched in version 1.3.2.
Patch / fix
- npm @kindspells/astro-shield 1.3.2
- kindspells astro-shield 1.3.2
Is CVE-2024-30250 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @kindspells/astro-shield | >=1.2.0, <1.3.2 |
1.3.2 |
Affected products
- kindspells astro-shield
Classification
- Weakness
-
- CWE-345 Insufficient Verification of Data Authenticity
References
-
github.com
/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a
web, patch
-
github.com
/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f
web, patch
-
github.com
/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc
web, vendor-advisory
-
github.com
/kindspells/astro-shield/releases/tag/1.3.2
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2024-30250
advisory
-
github.com
/kindspells/astro-shield
package
Sources
- CVE List CVE-2024-30250
- GitHub Advisory GHSA-c4gr-q97g-ppwc
- NVD CVE-2024-30250
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.