Описание
Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value such as duration can terminate the generated style element and inject arbitrary HTML or JavaScript. The affected code is packages/astro/src/runtime/server/transition.ts; renderTransition passes sheet.toString() into markHTMLString(), while addAnimationProperty serializes duration through toTimeValue() and also handles easing, direction, delay, fillMode, and name. Exploitation requires an on-demand or server-rendered route to pass attacker-controlled data into a View Transition animation definition and can execute arbitrary JavaScript in the affected application's origin, allowing access to sensitive page data and authenticated actions available to the victim. This issue is fixed in version 7.1.0.
A flaw was found in Astro. A remote attacker can exploit a reflected Cross-Site Scripting (XSS) vulnerability due to unescaped View Transition animation properties in the server-side CSS generator. By manipulating an animation value, such as 'duration', an attacker can inject arbitrary HTML or JavaScript. This allows for the execution of arbitrary JavaScript in the affected application's origin, potentially leading to access to sensitive page data and authenticated actions available to the victim.
Отчет
An input sanitization flaw in Astro's server-side View Transition CSS generator (packages/astro/src/runtime/server/transition.ts) allows unescaped animation properties to be rendered into inline style tags. When a server-rendered route passes attacker-controlled values (such as duration or easing) to a View Transition definition, the payload can break out of the HTML style element. This results in Cross-Site Scripting (XSS), enabling remote attackers to execute arbitrary JavaScript within the context of the victim's session.
Меры по смягчению последствий
Sanitize and validate all user-supplied inputs before assigning them to View Transition animation properties in dynamic routes, or temporarily disable server-side View Transitions for routes processing untrusted request parameters.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-feature-server-rhel9 | Affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
Связанные уязвимости
Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value such as duration can terminate the generated style element and inject arbitrary HTML or JavaScript. The affected code is packages/astro/src/runtime/server/transition.ts; renderTransition passes sheet.toString() into markHTMLString(), while addAnimationProperty serializes duration through toTimeValue() and also handles easing, direction, delay, fillMode, and name. Exploitation requires an on-demand or server-rendered route to pass attacker-controlled data into a View Transition animation definition and can execute arbitrary JavaScript in the affected application's origin, allowing access to sensitive page data and authenticated actions available to the victim. This issue is fixed in version 7.1.0.
Astro: Reflected XSS via unescaped View Transition animation properties
EPSS
8.1 High
CVSS3