GHSA-w2vj-39qv-7vh7 Astro development server error page is vulnerable to reflected Cross-site Scripting
SummaryA Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's development server error pages when the `trailingSlash` configuration option is used. An attacker can inject arbitrary JavaScript code that executes in the victim's browser context by crafting a malicious URL. While this vulnerability only affects the development server and not production builds, it could be exploited to compromise developer environments through social engineering or malicious links.DetailsVulnerability Locationhttps://github.com/withastro/astro/blob/5bc37fd5cade62f753aef66efdf40f982379029a/packages/astro/src/template/4xx.ts#L133-L149Root CauseThe vulnerability was introduced in commit `536175528` (PR #12994) , as part of a feature to "redirect trailing slashes on on-demand rendered pages." The feature added a helpful 404 error page in development mode to alert developers of trailing slash mismatches.**Issue**: The `corrected` variable, which is derived from the user-controlled `pathname` parameter, is directly interpolated into the HTML without proper escaping. While the `pathname` variable itself is escaped elsewhere in the same file (line 114: `escape(pathname)`), the `corrected` variable is not sanitized before being inserted into both the `href` attribute and the link text.Attack VectorWhen a developer has configured `trailingSlash` to `'always'` or `'never'` and visits a URL with a mismatched trailing slash, the development server returns a 404 page containing the vulnerable template. An attacker can craft a URL with JavaScript payloads that will be executed when the page is rendered.PoCLocal Testing (localhost)Basic vulnerability verification in local development environment`astro.config.mjs`:`package.json`:Start the development server:Access the following malicious URL depending on your configuration:**For `trailingSlash: 'never'`** (requires trailing slash):**For `trailingSlash: 'always'`** (no trailing slash):When accessing the malicious URL:The development server returns a 404 page due to trailing slash mismatchThe JavaScript payload (`alert(document.domain)`) executes in the browserAn alert dialog appears, demonstrating arbitrary code executionRemote Testing (ngrok)Reproduce realistic attack scenario via external malicious linkPrerequisites: ngrok account and authtoken configured (`ngrok config add-authtoken <key>`)Setup and Execution:When a remote user accesses either of the generated attack URLs:The request is tunneled through ngrok to the local development serverThe development server returns a 404 page due to trailing slash mismatchThe JavaScript payload (`alert(document.domain)`) executes in the user's browserBoth URL patterns work depending on your `trailingSlash` configuration ('never' or 'always').ImpactThis only affects the **development server**. Risk depends on how and where the dev server is exposed.Security impact**Developer environment compromise**: Visiting a crafted URL can run arbitrary JS in the developer's browser.**Session hijacking**: Active developer sessions can be stolen if services are open in the browser.**Local resource access**: JS may probe `localhost` endpoints or dev tools depending on browser policies.**Supply-chain risk**: Malicious packages or CI that start dev servers can widen exposure.Attack scenarios**Social engineering**: Malicious link sent to a developer triggers the XSS when opened.**Malicious documentation**: Attack URLs embedded in issues, PRs, chat, or docs.**Dependency/CI abuse**: Packages or automation that spawn public dev servers expose many targets.
CVSS v3.1 score: 2.7