CVE-2024-47885CWE-79

astro's client-side router has DOM Clobbering Gadget that leads to XSS

Medium · published October 14, 2024

CVSS v3.1
5.9
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1. It can lead to cross-site scripting (XSS) in websites enables Astro's client-side routing and has *stored* attacker-controlled scriptless HTML elements (i.e., `iframe` tags with unsanitized `name` attributes) on the destination pages. This vulnerability can result in cross-site scripting (XSS) attacks on websites that built with Astro that enable the client-side routing with `ViewTransitions` and store the user-inserted scriptless HTML tags without properly sanitizing the `name` attributes on the page. Version 4.16.1 contains a patch for this issue.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00445 · 37.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-10-14T19:06Z
EPSS history
Timeline
  • 14 OCT 19:06Z
    astro's client-side router has DOM Clobbering Gadget that leads to XSS
    cvelistv5