Executive Summary

This vulnerability affects the Astro web framework versions from 2.10.10 up to but not including 5.18.1. It involves the remotePatterns path enforcement used by server-side fetchers, such as the image optimization endpoint. The issue is that the path matching logic for wildcards (specifically /*) is unanchored, meaning that a pathname containing the allowed prefix later in the path can still match. Consequently, an attacker can exploit this to fetch paths outside the intended allowlisted prefix on an otherwise allowed host.

This flaw has been fixed in version 5.18.1 of Astro.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability can fetch resources outside the intended allowlisted paths on a permitted host. This could lead to unauthorized access to sensitive or restricted data that should not be accessible through the server-side fetchers.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Astro to version 5.18.1 or later, where the issue has been patched.

Useful 0 Not Useful 0