-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| astro | npm | < 5.15.8 | 5.15.8 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from a path normalization inconsistency within the Astro framework. Astro's router decodes URL-encoded characters in the request path (e.g., /%61dmin becomes /admin) for routing decisions. However, the middleware subsystem was provided with the raw, un-decoded path from the original request. This allowed an attacker to bypass middleware security checks (e.g., authentication for an /admin route) by sending a request with URL-encoded characters like /%61dmin. The middleware would fail to match the protected path, but the router would decode it and serve the protected content.
The vulnerability was present in two main areas:
handleRequest function in packages/astro/src/vite-plugin-astro-server/request.ts failed to decode the pathname before preparing the URL for the middleware context.RenderContext class in packages/astro/src/core/render-context.ts, which handles server-side rendering, similarly failed to normalize the URL pathname upon initialization and during route rewrites.The provided patch resolves this by consistently applying decodeURI() to the pathname in both the dev server and SSR contexts, ensuring that both the router and middleware operate on the same normalized path.
handleRequestpackages/astro/src/vite-plugin-astro-server/request.ts
RenderContext.constructorpackages/astro/src/core/render-context.ts
RenderContext.rewritepackages/astro/src/core/render-context.ts
Ongoing coverage of React2Shell