Listen to this Post
The vulnerability stems from an inconsistent path normalization process between Astro’s internal routing and the middleware context. Internally, Astro applies `decodeURI()` to the request pathname to determine the correct route for rendering. However, the middleware accesses the raw, undecoded `context.url.pathname` for validation checks. This discrepancy allows an attacker to submit a request with a URL-encoded path (e.g., /%61dmin). The middleware sees the raw string `”/%61dmin”` and does not trigger its protection logic for the `/admin` path. Internally, Astro decodes this path to `”/admin”` and correctly routes the request to the protected admin page, effectively bypassing the middleware’s authorization check.
Platform: Astro
Version: Pre-4.8.4
Vulnerability : Bypass
Severity: Critical
date: 2024-XX-XX
Prediction: 2024-11-15
What Undercode Say:
curl http://localhost:3000/%61dmin
// Bypass Check if (context.url.pathname === "/admin") // Blocked if (context.url.pathname === "/%61dmin") // Bypassed
// Patch Code - url.pathname = base + url.pathname; + url.pathname = base + decodeURI(url.pathname);
How Exploit:
Send encoded path requests.
Protection from this CVE
Update Astro version.
Normalize paths uniformly.
Impact:
Unauthorized access.
Bypassed authentication.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
