Listen to this Post
The vulnerability is a path traversal flaw in the Astro development server’s image optimization endpoint (/_image). In development mode (import.meta.env.DEV), the code in `packages/astro/src/assets/endpoint/node.ts` processes the `href` parameter without proper path validation. Unlike the production code path, which restricts file access to the allowed assets directory, the development branch directly uses user-supplied input to construct a file path. An attacker can provide an absolute path via a crafted HTTP GET request, such as /%2Fetc%2Fpasswd, which gets URL-decoded to /etc/passwd. The `loadLocalImage()` function then reads this file from the local filesystem, transforms it into an image (e.g., PNG), and returns its contents in the HTTP response, leading to arbitrary file disclosure.
Platform: Astro
Version: 5.x
Vulnerability: Path Traversal
Severity: Critical
date: 2024-12-19
Prediction: Patch 2025-01-10
What Undercode Say:
curl "http://localhost:4321/_image?href=/%2Fetc%2Fpasswd&w=100&h=100&f=png"
// Vulnerable code snippet from node.ts
if (import.meta.env.DEV) {
fileUrl = pathToFileURL(removeQueryString(replaceFileSystemReferences(src)));
}
How Exploit:
Craft GET request.
Use absolute paths.
Read local files.
Protection from this CVE
Update Astro version.
Restrict dev server access.
Validate input paths.
Impact:
Local file read.
Information disclosure.
High confidentiality loss.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
