{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "astro"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.16.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-56140"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-18T15:02:37Z",
    "nvd_published_at": "2024-12-18T21:15:08Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nA bug in Astro\u2019s CSRF-protection middleware allows requests to bypass CSRF checks.\n\n### Details\n\nWhen the `security.checkOrigin` configuration option is set to `true`, Astro middleware will perform a CSRF check. (Source code: https://github.com/withastro/astro/blob/6031962ab5f56457de986eb82bd24807e926ba1b/packages/astro/src/core/app/middlewares.ts)\n\nFor example, with the following Astro configuration:\n\n```js\n// astro.config.mjs\nimport { defineConfig } from \u0027astro/config\u0027;\nimport node from \u0027@astrojs/node\u0027;\n\nexport default defineConfig({\n\toutput: \u0027server\u0027,\n\tsecurity: { checkOrigin: true },\n\tadapter: node({ mode: \u0027standalone\u0027 }),\n});\n```\n\nA request like the following would be blocked if made from a different origin:\n\n```js\n// fetch API or \u003cform action=\"https://test.example.com/\" method=\"POST\"\u003e\nfetch(\u0027https://test.example.com/\u0027, {\n\tmethod: \u0027POST\u0027,\n\tcredentials: \u0027include\u0027,\n\tbody: \u0027a=b\u0027,\n\theaders: { \u0027Content-Type\u0027: \u0027application/x-www-form-urlencoded\u0027 },\n});\n// =\u003e Cross-site POST form submissions are forbidden\n```\n\nHowever, a vulnerability exists that can bypass this security.\n\n#### Pattern 1: Requests with a semicolon after the `Content-Type`\n\nA semicolon-delimited parameter is allowed after the type in `Content-Type`.\n\nWeb browsers will treat a `Content-Type` such as `application/x-www-form-urlencoded; abc` as a [simple request](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests) and will not perform preflight validation. In this case, CSRF is not blocked as expected.\n\n```js\nfetch(\u0027https://test.example.com\u0027, {\n\tmethod: \u0027POST\u0027,\n\tcredentials: \u0027include\u0027,\n\tbody: \u0027test\u0027,\n\theaders: { \u0027Content-Type\u0027: \u0027application/x-www-form-urlencoded; abc\u0027 },\n});\n// =\u003e Server-side functions are executed (Response Code 200).\n```\n\n#### Pattern 2: Request without `Content-Type` header\n\nThe `Content-Type` header is not required for a request. The following examples are sent without a `Content-Type` header, resulting in CSRF.\n\n```js\n// Pattern 2.1 Request without body\nfetch(\u0027http://test.example.com\u0027, { method: \u0027POST\u0027, credentials: \u0027include\u0027 });\n\n// Pattern 2.2 Blob object without type\nfetch(\u0027https://test.example.com\u0027, {\n\tmethod: \u0027POST\u0027,\n\tcredentials: \u0027include\u0027,\n\tbody: new Blob([\u0027a=b\u0027], {}),\n});\n```\n\n### Impact\n\nBypass CSRF protection implemented with CSRF middleware.\n\n\u003e [!Note]\n\u003e Even with `credentials: \u0027include\u0027`, browsers may not send cookies due to third-party cookie blocking. This feature depends on the browser version and settings, and is for privacy protection, not as a CSRF measure.",
  "id": "GHSA-c4pw-33h3-35xw",
  "modified": "2025-11-27T08:01:13Z",
  "published": "2024-12-18T15:02:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-c4pw-33h3-35xw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56140"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/commit/e7d14c374b9d45e27089994a4eb72186d05514de"
    },
    {
      "type": "WEB",
      "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/withastro/astro"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/blob/6031962ab5f56457de986eb82bd24807e926ba1b/packages/astro/src/core/app/middlewares.ts"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Atro CSRF Middleware Bypass (security.checkOrigin)"
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:astro:astro:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "EC2DFB09-8B1E-4AA4-AADA-D16A2D4423C4",
              "versionEndExcluding": "4.16.17",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Astro is a web framework for content-driven websites. In affected versions a bug in Astro\u2019s CSRF-protection middleware allows requests to bypass CSRF checks. When the `security.checkOrigin` configuration option is set to `true`, Astro middleware will perform a CSRF check. However, a vulnerability exists that can bypass this security. A semicolon-delimited parameter is allowed after the type in `Content-Type`. Web browsers will treat a `Content-Type` such as `application/x-www-form-urlencoded; abc` as a `simple request` and will not perform preflight validation. In this case, CSRF is not blocked as expected. Additionally, the `Content-Type` header is not required for a request. This issue has been addressed in version 4.16.17 and all users are advised to upgrade. There are no known workarounds for this vulnerability."
    },
    {
      "lang": "es",
      "value": "Astro es un framework para sitios web basados en contenido. En las versiones afectadas, un error en el middleware de protecci\u00f3n CSRF de Astro permite que las solicitudes eludan las comprobaciones CSRF. Cuando la opci\u00f3n de configuraci\u00f3n `security.checkOrigin` se establece en `true`, el middleware Astro realizar\u00e1 una comprobaci\u00f3n CSRF. Sin embargo, existe una vulnerabilidad que puede eludir esta seguridad. Se permite un par\u00e1metro delimitado por punto y coma despu\u00e9s del tipo en `Content-Type`. Los navegadores web tratar\u00e1n un `Content-Type` como `application/x-www-form-urlencoded; abc` como una `solicitud simple` y no realizar\u00e1n una validaci\u00f3n previa. En este caso, CSRF no se bloquea como se esperaba. Adem\u00e1s, el encabezado `Content-Type` no es necesario para una solicitud. Este problema se ha solucionado en la versi\u00f3n 4.16.17 y se recomienda a todos los usuarios que actualicen. No existen workarounds conocidos para esta vulnerabilidad."
    }
  ],
  "id": "CVE-2024-56140",
  "lastModified": "2025-11-25T13:42:59.937",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-12-18T21:15:08.353",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Technical Description"
      ],
      "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/withastro/astro/blob/6031962ab5f56457de986eb82bd24807e926ba1b/packages/astro/src/core/app/middlewares.ts"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/withastro/astro/commit/e7d14c374b9d45e27089994a4eb72186d05514de"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-c4pw-33h3-35xw"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}