CVE-2024-56140

CVE-2024-56140 affects the Astro CSRF-protection middleware. A semicolon-delimited parameter after the Content-Type (e.g., application/x-www-form-urlencoded; abc) causes the request to be treated as a simple request, bypassing preflight validation and CSRF checks when security.checkOrigin is true...

CVE-2024-56140 Bypass of CSRF Middleware in Astro

Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. When the security.checkOrigin configuration option is set to true, Astro middleware will perform a CSRF check. However, a vulnerability...

@bookshop/browser (3.11.0-rc.0), @bookshop/generate (3.11.0-rc.0) +24 more potentially affected by CVE-2024-56140 via astro (>=4.0.3, <=4.16.16)

astro NPM version =4.0.3, =0.40.5, =0.38.0, =0.38.0, =2.8.4, =0.2.0, =0.0.0-dev-20231211183354, =0.0.3, =0.0.3, =0.0.5, =0.0.1, =1.0.2, =1.0.9 - @thewebforge/astro-og-images 3.0.0 and more Source cves: CVE-2024-56140 Source advisory: OSV:GHSA-C4PW-33H3-35XW...