Astro Web Framework Allows Unauthorized Image Fetching

Summary

Astro's image processing feature can be tricked into fetching images from unauthorized sources, potentially allowing attackers to access internal network services or cloud metadata. To fix this, update to version 9.5.4 or later. If an update is not possible, consider disabling the `inferSize` option to prevent unauthorized image fetching.

What to do

Update astrojs node to version 9.5.4.

Affected software

Vendor	Product	Affected versions	Fix available
astrojs	node	> 9.0.0 , <= 9.5.4	9.5.4
astro	\@astrojs\/node	> 9.0.0 , <= 9.5.4	–

Original title

Astro is a web framework. In versions 9.0.0 through 9.5.3, a bug in Astro's image pipeline allows bypassing `image.domains` / `image.remotePatterns` restrictions, enabling the server to fetch conte...

Original description

Astro is a web framework. In versions 9.0.0 through 9.5.3, a bug in Astro's image pipeline allows bypassing `image.domains` / `image.remotePatterns` restrictions, enabling the server to fetch content from unauthorized remote hosts. Astro provides an `inferSize` option that fetches remote images at render time to determine their dimensions. Remote image fetches are intended to be restricted to domains the site developer has manually authorized (using the `image.domains` or `image.remotePatterns` options). However, when `inferSize` is used, no domain validation is performed — the image is fetched from any host regardless of the configured restrictions. An attacker who can influence the image URL (e.g., via CMS content or user-supplied data) can cause the server to fetch from arbitrary hosts. This allows bypassing `image.domains` / `image.remotePatterns` restrictions to make server-side requests to unauthorized hosts. This includes the risk of server-side request forgery (SSRF) against internal network services and cloud metadata endpoints. Version 9.5.4 fixes the issue.

nvd CVSS3.1 6.5

Vulnerability type

CWE-918 Server-Side Request Forgery (SSRF)