Listen to this Post
The vulnerability exists within Astro’s server islands endpoint (/_server-islands/
</code>). This endpoint accepts an `e` parameter to specify the component export type. Normally, this is set to <code>default</code>. However, if an attacker sets the `e` parameter to <code>file</code>, the endpoint returns the absolute file path of the island component as a string. This string value triggers a different code path that dynamically constructs an HTML template. This template uses the sanitized file path as the parent HTML tag name. The `s` parameter, which is for slot content, is then injected as a child of this tag without proper sanitization. Since the content from the `s` parameter is passed through `markHTMLString` but not escaped, any malicious JavaScript payload provided in the `s` parameter is rendered and executed directly in the victim's browser, leading to a reflected Cross-Site Scripting attack. This occurs even if the original Astro component template is completely empty and was never designed to use slots, as the vulnerable code path creates its own template independently.
Platform: Astro
Version: <=5.15.6
Vulnerability: Reflected XSS
Severity: Critical
date: 2025-01-XX
<h2 style="color: blue;">Prediction: Patch by 2025-02-15</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
[bash]
curl "http://localhost:4321/_server-islands/ServerTime?e=file&p=&s={\"x\":\"<img src=x onerror=alert(document.domain)>\"}"
// Payload in 's' parameter
const maliciousPayload = {"anykey":"<script>alert('XSS')</script>"};
const encodedPayload = encodeURIComponent(JSON.stringify(maliciousPayload));
How Exploit:
Attacker crafts a malicious URL with the `e` parameter set to `file` and the `s` parameter containing a JSON object with an XSS payload. The victim is tricked into visiting this URL, which causes their browser to execute the attacker's script in the context of the vulnerable Astro application.
Protection from this CVE
Update Astro to a patched version immediately. If an immediate update is not possible, implement a middleware or server-side rule to block or sanitize requests to the `/_server-islands/` endpoint that have the `e` parameter set to `file` or url.
Impact:
Arbitrary JavaScript execution, session hijacking, account takeover, and defacement of the vulnerable application.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
