CVE-2024-29896: Kindspells Astro-shield XSS Vulnerability

CVE-2024-29896 Overview

CVE-2024-29896 affects Astro-Shield, a library that computes Subresource Integrity (SRI) hashes for JavaScript and CSS resources in Astro applications. When automated Content Security Policy (CSP) header generation for server-side rendered (SSR) content is enabled, the library can inadvertently allow-list attacker-controlled resources. If a web application serves content that external users can partially influence, malicious injected inline scripts or references to external scripts may be added to the generated CSP allow-list. The flaw is classified under [CWE-74] (Improper Neutralization of Special Elements in Output). The issue is fixed in astro-shield version 1.3.0.

Critical Impact
Attackers can bypass CSP protections by injecting content that Astro-Shield then automatically allow-lists, enabling script injection attacks against SSR-rendered pages.

Affected Products

KindSpells Astro-Shield 1.2.0 and earlier
Astro applications using enableMiddleware_SRI with automated CSP generation
SSR-rendered Astro sites accepting user-influenced content

Discovery Timeline

2024-03-28 - CVE-2024-29896 published to NVD
2025-09-19 - Last updated in NVD database

Technical Details for CVE-2024-29896

Vulnerability Analysis

Astro-Shield computes SRI hashes for scripts and stylesheets encountered during page rendering. When the middleware-based CSP generation feature is enabled, the library walks the rendered HTML, hashes each <script> and <style> element it observes, and adds those hashes to the script-src and style-src CSP directives.

The vulnerability stems from the library treating every script and style found in the rendered output as legitimate. If the application reflects user-controlled content into the response, an attacker can inject a <script> tag whose hash Astro-Shield then computes and writes into the CSP header. The CSP that should prevent script injection instead authorizes the injected payload.

Root Cause

The automated CSP generation logic did not distinguish between application-authored resources and resources discovered in the rendered output. There was no allow-list of trusted origins or content boundaries, so any inline script reaching the renderer was promoted to a trusted hash in the resulting CSP directive.

Attack Vector

The attack is network-based and requires no authentication. An attacker submits content containing inline script or external script references through any input that the SSR pipeline reflects into HTML. Astro-Shield hashes the injected script, appends the hash to script-src, and the browser executes the payload as a trusted resource.

text

// Patch excerpt from src/headers.mjs
	if (pageHashes.scripts.size > 0) {
		setSrcDirective(directives, 'script-src', pageHashes.scripts)
+	} else {
+		directives['script-src'] = "'none'"
	}
	if (pageHashes.styles.size > 0) {
		setSrcDirective(directives, 'style-src', pageHashes.styles)
+	} else {
+		directives['style-src'] = "'none'"
	}

Source: KindSpells Astro-Shield commit 41b8457. The patch hardens directive emission and introduces cross-origin resource allow-lists so attacker-supplied scripts are no longer trusted by default.

Detection Methods for CVE-2024-29896

Indicators of Compromise

Unexpected sha256-, sha384-, or sha512- hashes appearing in Content-Security-Policy response headers on SSR pages
CSP script-src directives containing hashes that do not correspond to application-authored scripts
Reflected user input in HTML responses adjacent to inline <script> blocks
Browser execution of scripts whose source matches user-submitted form fields or query parameters

Detection Strategies

Compare CSP headers produced in production against a known baseline of expected script and style hashes
Scan dependency manifests (package.json, package-lock.json) for @kindspells/astro-shield versions below 1.3.0
Review SSR rendering pipelines for paths that interpolate user input into HTML without contextual escaping

Monitoring Recommendations

Log full CSP response headers from edge or reverse proxy tiers and alert on hash-set drift
Monitor web application firewall events for HTML and script tag patterns in request bodies and query strings
Track outbound script execution telemetry from client-side runtime protection or RUM tooling for unexpected origins

How to Mitigate CVE-2024-29896

Immediate Actions Required

Upgrade @kindspells/astro-shield to version 1.3.0 or later across all Astro projects
Audit SSR routes for reflected input and apply contextual output encoding before rendering
Temporarily disable enableMiddleware_SRI automated CSP generation on routes that render user-influenced content until patched

Patch Information

The fix is included in Astro-Shield 1.3.0 via commit 41b84576d37fa486a57005ea297658d0bc38566d. The patch defaults script-src and style-src to 'none' when no application hashes are collected and adds explicit cross-origin resource allow-lists. Details are in the KindSpells GHSA-w387-5qqw-7g8m advisory.

Workarounds

Author a static, manually maintained CSP header instead of relying on automated generation for routes serving user content
Sanitize and HTML-encode any user-controlled data before it reaches the SSR renderer
Restrict script-src to a fixed nonce or hash list managed outside Astro-Shield until the upgrade is deployed

bash

# Configuration example
npm install @kindspells/astro-shield@^1.3.0
npm ls @kindspells/astro-shield