CVE-2024-56159— Astro 安全漏洞
一分钟漏洞结论
影响对象
withastro astro
利用判断
存在公开或 AI PoC，应优先验证
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Astro是Astro开源的一个内容驱动网站的 web 框架。 Astro 5.0.7及之前版本和4.16.17及之前版本存在安全漏洞，该漏洞源于服务器代码的sourcemap文件被移到了公共可访问的文件夹，导致未认证用户可通过HTTP GET请求读取部分服务器源代码。
公开利用映射 1
Nuclei · 1
CVE-2024-56159.yaml [template]
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2024-56159 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Server source code is exposed to the public if sourcemaps are enabled
来源: CVE Program / CVE List V5
Vulnerability Description
Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. During build, along with client assets such as css and font files, the sourcemap files **for the server code** are moved to a publicly-accessible folder. Any outside party can read them with an unauthorized HTTP GET request to the same server hosting the rest of the website. While some server files are hashed, making their access obscure, the files corresponding to the file system router (those in `src/pages`) are predictably named. For example. the sourcemap file for `src/pages/index.astro` gets named `dist/client/pages/index.astro.mjs.map`. This vulnerability is the root cause of issue #12703, which links to a simple stackblitz project demonstrating the vulnerability. Upon build, notice the contents of the `dist/client` (referred to as `config.build.client` in astro code) folder. All astro servers make the folder in question accessible to the public internet without any authentication. It contains `.map` files corresponding to the code that runs on the server. All **server-output** projects on Astro 5 versions **v5.0.3** through **v5.0.7**, that have **sourcemaps enabled**, either directly or through an add-on such as `sentry`, are affected. The fix for **server-output** projects was released in **astro@5.0.8**. Additionally, all **static-output** projects built using Astro 4 versions **4.16.17 or older**, or Astro 5 versions **5.0.8 or older**, that have **sourcemaps enabled** are also affected. The fix for **static-output** projects was released in **astro@5.0.9**, and backported to Astro v4 in **astro@4.16.18**. The immediate impact is limited to source code. Any secrets or environment variables are not exposed unless they are present verbatim in the source code. There is no immediate loss of integrity within the the vulnerable server. However, it is possible to subsequently discover another vulnerability via the revealed source code . There is no immediate impact to availability of the vulnerable server. However, the presence of an unsafe regular expression, for example, can quickly be exploited to subsequently compromise the availability. The fix for **server-output** projects was released in **astro@5.0.8**, and the fix for **static-output** projects was released in **astro@5.0.9** and backported to Astro v4 in **astro@4.16.18**. Users are advised to update immediately if they are using sourcemaps or an integration that enables sourcemaps.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L
来源: CVE Program / CVE List V5
Vulnerability Type
Web根目录下的敏感数据
来源: CVE Program / CVE List V5
Vulnerability Title
Astro 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Astro是Astro开源的一个内容驱动网站的 web 框架。 Astro 5.0.7及之前版本和4.16.17及之前版本存在安全漏洞，该漏洞源于服务器代码的sourcemap文件被移到了公共可访问的文件夹，导致未认证用户可通过HTTP GET请求读取部分服务器源代码。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2024-56159 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | Astro versions v5.0.3 through v5.0.7 and Astro v4.16.17 or older with sourcemaps enabled contain a source code disclosure caused by sourcemap files being publicly accessible in the build output folder, letting unauthenticated users read server source code, exploit requires sourcemaps to be enabled. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-56159.yaml | POC详情 |
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2024-56159 的情报信息
请登录查看更多情报信息。
CVE-2024-56159 补丁与修复 (1)
CVE-2024-56159 厂商安全公告 (1)
CVE-2024-56159 其他参考 (2)
-
Astro 5 breaks sourcemaps · Issue #12703 · withastro/astro x_refsource_MISC
IV. Related Vulnerabilities
V. Comments for CVE-2024-56159
匿名用户
2026-01-15 06:08:29Zaproxy alias impedit expedita quisquam pariatur exercitationem. Nemo rerum eveniet dolores rem quia dignissimos.