CVE-2024-561597.8HighCWE-219

CVE-2024-56159: Server source code is exposed to the public if sourcemaps are enabled

withastro · astro

Affected: withastro astro · Exploitation: check available, not yet exploited

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

1.5%probability of exploitation in the next 30 days

75th percentile

050100

Higher than 75% of scored CVEs

7.8HighCVSS 4.0

LowMediumHighCrit.

DescriptionCVE.org

Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. During build, along with client assets such as css and font files, the sourcemap files for the server code are moved to a publicly-accessible folder. Any outside party can read them with an unauthorized HTTP GET request to the same server hosting the rest of the website. While some server files are hashed, making their access obscure, the files corresponding to the file system router (those in `src/pages`) are predictably named. For example. the sourcemap file for `src/pages/index.astro` gets named `dist/client/pages/index.astro.mjs.map`. This vulnerability is the root cause of issue #12703, which links to a simple stackblitz project demonstrating the vulnerability. Upon build, notice the contents of the `dist/client` (referred to as `config.build.client` in astro code) folder. All astro servers make the folder in question accessible to the public internet without any authentication. It contains `.map` files corresponding to the code that runs on the server. All server-output projects on Astro 5 versions v5.0.3 through v5.0.7, that have sourcemaps enabled, either directly or through an add-on such as `sentry`, are affected. The fix for server-output projects was released in astro@5.0.8. Additionally, all static-output projects built using Astro 4 versions 4.16.17 or older, or Astro 5 versions 5.0.8 or older, that have sourcemaps enabled are also affected. The fix for static-output projects was released in astro@5.0.9, and backported to Astro v4 in astro@4.16.18. The immediate impact is limited to source code. Any secrets or environment variables are not exposed unless they are present verbatim in the source code. There is no immediate loss of integrity within the the vulnerable server. However, it is possible to subsequently discover another vulnerability via the revealed source code .

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

withastro · astro>= 5.0.0, < 5.0.8; < 4.16.18

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
CISA KEV: Not listed
Public check: Astro - Information Disclosure · nuclei template in projectdiscovery/nuclei-templates
Weakness: Storage of File with Sensitive Data Under Web Root · Information Disclosure
Vendor: withastro
Published: December 2024
Band: Check available, not yet exploited, December 2024

CoverageNo articles yet

No CyberSIXT article names CVE-2024-56159 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.