AstroBlocksに管理者なりすまし脆弱性、3.4.0で修正
Summary
AstroBlocksの3.4.0より前では、第三者が管理者のセッショントークンを偽造し、CMSを丸ごと操作できます。3.4.0に更新して署名用のシークレットを設定し、不審な管理操作がないかも調べてください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
AstroBlocksの3.4.0より前では、第三者が管理者のセッショントークンを偽造し、CMSを丸ごと操作できます。3.4.0に更新して署名用のシークレットを設定し、不審な管理操作がないかも調べてください。
Original description The description as published by the source.
AstroBlocks is a block-first CMS for Astro projects. Prior to version 3.4.0, admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value (readable in the published package) can forge a valid session token with role: "owner" and obtain full administrative control of the CMS — creating/deleting content, users, media, redirects, and configuration. This issue has been patched in version 3.4.0.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- web github.com