Astro URL Double-encoding Bypass Vulnerability and Patch

Vulnerability Overview This vulnerability involves excessive URL decoding, which may lead to security bypasses or denial-of-service attacks. Specifically, during URL path decoding, excessive encoding levels can cause the path to be incorrectly parsed, thereby bypassing middleware security checks. Scope of Impact Affected Components: , , , , Affected Versions: Astro 6.4.8 and earlier versions Remediation Steps 1. Limit Decoding Iterations: In , the constant was added to limit the maximum number of URL path decoding iterations to 10. 2. Error Handling: In and , handling for was added. When excessive encoding of the URL path is detected, a 400 Bad Request status code is returned. 3. Middleware Checks: In , a check for was added. If invalid decoding is detected, a 400 error is returned immediately to prevent subsequent middleware processing. 4. Test Cases: The test case was added to verify that the behavior after remediation meets expectations. Proof of Concept (POC) Code ```typescript // double-encoding-bypass.test.ts describe('URL normalization: double-encoding middleware bypass', () => { it('blocks /api/admin even when middleware calls next(context.url)', async () => { const app = createApp(createRewriteAuthMiddleware()); const response = await app.render(new Request('http://example.com/api/admin')); assert.equal(response.status, 401, '/api/admin must be blocked by middleware'); }); it('blocks double-encoded /api/%2561dmin with a rewriting middleware', async () => { // This decodes to /api/admin, so middleware must see /api/admin and // block it, even though the request is then sent back through routing. const app = createApp(createRewriteAuthMiddleware()); const response = await app.render(new Request('http://example.com/api/%2561dmin')); assert.equal(response.status, 401, 'double-encoded /api/admin must be blocked even with a rewriting middleware'); }); it('rejects an over-encoded path with 400 instead of bypassing to /api/admin', async () => { // Encoded more times than we decode const app = createApp(createRewriteAuthMiddleware()); const response = await app.render(new Request('http://example.com/api/%25252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525

Goal Reached Thanks to every supporter — we hit 100%!

Astro URL Double-encoding Bypass Vulnerability and Patch

More from this source