CVE-2024-30250: Astro-Shield Auth Bypass Vulnerability

CVE-2024-30250 Overview

CVE-2024-30250 affects Astro-Shield, an integration that strengthens website security through SubResource Integrity (SRI) hashes and Content-Security-Policy (CSP) headers. Versions 1.2.0 through 1.3.1 contain a flaw that allows attackers to bypass the cross-origin resource allow-list. An attacker who can inject markup into a generated page can supply a valid integrity attribute on the injected element. Astro-Shield then adds the attacker-controlled SRI hash to the generated CSP header, causing the browser to trust the injected resource. The maintainer patched the issue in version 1.3.2 [CWE-345: Insufficient Verification of Data Authenticity].

Critical Impact
Attackers can bypass CSP allow-list controls and execute untrusted cross-origin resources as if they were authorized by the site.

Affected Products

Kindspells Astro-Shield 1.2.0 through 1.3.1
Astro projects relying on Astro-Shield SRI hash generation
Astro projects relying on Astro-Shield CSP header generation

Discovery Timeline

2024-04-04 - CVE-2024-30250 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30250

Vulnerability Analysis

Astro-Shield scans rendered HTML for <script> and <link> elements that load cross-origin resources, generates SRI hashes for those resources, and adds matching hashes to the CSP header. The integration assumes that any element it processes originated from the trusted source code. When versions 1.2.0 to 1.3.1 encounter an element that already carries an integrity attribute, the value is accepted as authoritative. The supplied hash is then promoted into the CSP script-src or style-src directive without an authenticity check.

An attacker who can inject HTML into a rendered Astro page can supply both a malicious resource URL and a precomputed hash of that resource. The browser fetches the resource, verifies the integrity value matches, and finds the same hash listed in CSP. Both layers of defense pass, and the injected payload executes.

Root Cause

The root cause is insufficient verification of data authenticity in the SRI and CSP generation logic. Astro-Shield trusts integrity attributes present on elements it processes rather than computing hashes only for resources defined in trusted templates. This collapses the distinction between developer-authored references and content introduced through markup injection.

Attack Vector

Exploitation requires a separate primitive that lets the attacker introduce HTML into a page processed by Astro-Shield, such as a stored content injection point or an unsafe templating pattern. Once injection is possible, the attacker includes a <script> element pointing to an attacker-controlled origin and a valid SHA-based integrity value for that script. Astro-Shield ingests the element, lifts the hash into the generated CSP header, and the browser executes the third-party script. The vulnerability does not require authentication or user interaction beyond visiting the affected page.

No verified exploit code or public proof-of-concept is available. See the GitHub Security Advisory GHSA-c4gr-q97g-ppwc for the maintainer description.

Detection Methods for CVE-2024-30250

Indicators of Compromise

Generated CSP headers that contain sha256-, sha384-, or sha512- hashes corresponding to scripts hosted on origins not listed in project configuration.
<script> or <link> elements in rendered output referencing unexpected third-party domains alongside an integrity attribute.
Browser console entries showing successful loads of cross-origin scripts that were never declared in source templates.

Detection Strategies

Compare CSP hashes emitted at runtime against a known-good list derived from build-time templates. Flag any additions.
Inspect server logs for outbound fetches by the Astro build or SSR process to domains not in the configured allow-list.
Run dependency inventory checks to identify deployments still pinned to astro-shield versions 1.2.0 through 1.3.1.

Monitoring Recommendations

Enable CSP report-uri or report-to collection and alert on resources loaded from unexpected origins.
Monitor source control and CI pipelines for changes to Astro-Shield configuration or for unexpected integrity attributes in templates and content sources.
Track upstream advisories on the Astro-Shield GitHub repository for further fixes.

How to Mitigate CVE-2024-30250

Immediate Actions Required

Upgrade astro-shield to version 1.3.2 or later in all affected projects.
Audit content sources, CMS fields, and Markdown inputs for injected <script> or <link> elements carrying integrity attributes.
Rebuild and redeploy any site that produced CSP headers while running an affected Astro-Shield version.

Patch Information

The fix is delivered in Astro-Shield 1.3.2. The relevant code changes are published in commits 1221019 and 5ae8b8e. The release notes are documented in the 1.3.2 release tag.

Workarounds

Strip integrity attributes from any HTML content that originates outside trusted templates before Astro-Shield processes the page.
Restrict cross-origin script and style sources to a static, explicit allow-list at a reverse proxy or edge layer until the upgrade is complete.
Disable Astro-Shield's automatic SRI and CSP generation for routes that render user-supplied HTML until the project is upgraded.

bash

# Configuration example
npm install astro-shield@^1.3.2
npm ls astro-shield