{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-30250", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-26T12:52:00.933Z", "datePublished": "2024-04-04T14:57:51.671Z", "dateUpdated": "2024-08-02T01:32:05.408Z"}, "containers": {"cna": {"title": "In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists", "problemTypes": [{"descriptions": [{"cweId": "CWE-345", "lang": "en", "description": "CWE-345: Insufficient Verification of Data Authenticity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc"}, {"name": "https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a", "tags": ["x_refsource_MISC"], "url": "https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a"}, {"name": "https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f", "tags": ["x_refsource_MISC"], "url": "https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f"}, {"name": "https://github.com/kindspells/astro-shield/releases/tag/1.3.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/kindspells/astro-shield/releases/tag/1.3.2"}], "affected": [{"vendor": "kindspells", "product": "astro-shield", "versions": [{"version": ">= 1.2.0, < 1.3.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-04T14:57:51.671Z"}, "descriptions": [{"lang": "en", "value": "Astro-Shield is an integration to enhance website security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques. Versions from 1.2.0 to 1.3.1 of Astro-Shield allow bypass to the allow-lists for cross-origin resources by introducing valid `integrity` attributes to the injected code. This implies that the injected SRI hash would be added to the generated CSP header, which would lead the browser to believe that the injected resource is legit. This vulnerability is patched in version 1.3.2."}], "source": {"advisory": "GHSA-c4gr-q97g-ppwc", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "kindspells", "product": "astro-shield", "cpes": ["cpe:2.3:a:kindspells:astro-shield:1.2.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1.2.0", "status": "affected", "lessThan": "1.3.2", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-04-05T17:38:23.724265Z", "id": "CVE-2024-30250", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-20T15:09:34.569Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:32:05.408Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc"}, {"name": "https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a"}, {"name": "https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f"}, {"name": "https://github.com/kindspells/astro-shield/releases/tag/1.3.2", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/kindspells/astro-shield/releases/tag/1.3.2"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc", "name": "https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a", "name": "https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f", "name": "https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/kindspells/astro-shield/releases/tag/1.3.2", "name": "https://github.com/kindspells/astro-shield/releases/tag/1.3.2", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:32:05.408Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-30250", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-05T17:38:23.724265Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:kindspells:astro-shield:1.2.0:*:*:*:*:*:*:*"], "vendor": "kindspells", "product": "astro-shield", "versions": [{"status": "affected", "version": "1.2.0", "lessThan": "1.3.2", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-20T15:08:35.673Z"}}], "cna": {"title": "In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists", "source": {"advisory": "GHSA-c4gr-q97g-ppwc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "kindspells", "product": "astro-shield", "versions": [{"status": "affected", "version": ">= 1.2.0, < 1.3.2"}]}], "references": [{"url": "https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc", "name": "https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a", "name": "https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f", "name": "https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/kindspells/astro-shield/releases/tag/1.3.2", "name": "https://github.com/kindspells/astro-shield/releases/tag/1.3.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Astro-Shield is an integration to enhance website security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques. Versions from 1.2.0 to 1.3.1 of Astro-Shield allow bypass to the allow-lists for cross-origin resources by introducing valid `integrity` attributes to the injected code. This implies that the injected SRI hash would be added to the generated CSP header, which would lead the browser to believe that the injected resource is legit. This vulnerability is patched in version 1.3.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "CWE-345: Insufficient Verification of Data Authenticity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-04T14:57:51.671Z"}}}, "cveMetadata": {"cveId": "CVE-2024-30250", "state": "PUBLISHED", "dateUpdated": "2024-08-02T01:32:05.408Z", "dateReserved": "2024-03-26T12:52:00.933Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-04-04T14:57:51.671Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Astro-Shield is an integration to enhance website security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques. Versions from 1.2.0 to 1.3.1 of Astro-Shield allow bypass to the allow-lists for cross-origin resources by introducing valid `integrity` attributes to the injected code. This implies that the injected SRI hash would be added to the generated CSP header, which would lead the browser to believe that the injected resource is legit. This vulnerability is patched in version 1.3.2."}, {"lang": "es", "value": "Astro-Shield es una integraci\u00f3n para mejorar la seguridad del sitio web con hashes de integridad de subrecursos, encabezados de pol\u00edtica de seguridad de contenido y otras t\u00e9cnicas. Las versiones de 1.2.0 a 1.3.1 de Astro-Shield permiten eludir las listas permitidas para recursos de origen cruzado al introducir atributos de \"integridad\" v\u00e1lidos en el c\u00f3digo inyectado. Esto implica que el hash SRI inyectado se agregar\u00eda al encabezado CSP generado, lo que llevar\u00eda al navegador a creer que el recurso inyectado es leg\u00edtimo. Esta vulnerabilidad est\u00e1 parcheada en la versi\u00f3n 1.3.2."}], "id": "CVE-2024-30250", "lastModified": "2024-04-04T16:33:06.610", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-04-04T15:15:39.240", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a"}, {"source": "security-advisories@github.com", "url": "https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f"}, {"source": "security-advisories@github.com", "url": "https://github.com/kindspells/astro-shield/releases/tag/1.3.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}