CVE-2024-56159
Astro ≤ 4.16.18
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2024-56159 is a high-severity Storage of File with Sensitive Data Under Web Root (CWE-219) vulnerability in Astro Astro. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 28% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Astro, a web framework for content-driven sites, contains a build-process flaw that inadvertently exposes server-side source maps. During compilation, sourcemap files for server code are copied into the publicly served client-asset directory alongside CSS and fonts. The issue affects all server-output projects running Astro 5.0.3–5.0.7 with sourcemaps enabled (directly or via integrations such as Sentry) and all static-output projects built with Astro 4.16.17 or earlier or Astro 5.0.8 or earlier when sourcemaps are active.
An unauthenticated remote attacker can simply issue an HTTP GET request for the predictable paths under the dist/client directory—for example, dist/client/pages/index.astro.mjs.map—to retrieve portions of the server source. While hashed files are harder to locate, the file-system router outputs remain guessable, allowing an adversary to inspect application logic and potentially discover additional vulnerabilities such as unsafe regular expressions or hardcoded secrets.
The project’s security advisories (GHSA-49w6-73cw-chjr) and release notes state that the exposure is eliminated by upgrading server-output sites to astro@5.0.8 and static-output sites to astro@5.0.9 (or the backported astro@4.16.18). Users are advised to update immediately if sourcemaps are enabled or supplied by any integration.
EPSS for the CVE has climbed from a low baseline to a peak of 0.1315 (current value 0.1078), indicating that exploitation interest emerged after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-3552
Vulnerability Data
Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. During build, along with client assets such as css and font files, the sourcemap…
more
files **for the server code** are moved to a publicly-accessible folder. Any outside party can read them with an unauthorized HTTP GET request to the same server hosting the rest of the website. While some server files are hashed, making their access obscure, the files corresponding to the file system router (those in `src/pages`) are predictably named. For example. the sourcemap file for `src/pages/index.astro` gets named `dist/client/pages/index.astro.mjs.map`. This vulnerability is the root cause of issue #12703, which links to a simple stackblitz project demonstrating the vulnerability. Upon build, notice the contents of the `dist/client` (referred to as `config.build.client` in astro code) folder. All astro servers make the folder in question accessible to the public internet without any authentication. It contains `.map` files corresponding to the code that runs on the server. All **server-output** projects on Astro 5 versions **v5.0.3** through **v5.0.7**, that have **sourcemaps enabled**, either directly or through an add-on such as `sentry`, are affected. The fix for **server-output** projects was released in **astro@5.0.8**. Additionally, all **static-output** projects built using Astro 4 versions **4.16.17 or older**, or Astro 5 versions **5.0.8 or older**, that have **sourcemaps enabled** are also affected. The fix for **static-output** projects was released in **astro@5.0.9**, and backported to Astro v4 in **astro@4.16.18**. The immediate impact is limited to source code. Any secrets or environment variables are not exposed unless they are present verbatim in the source code. There is no immediate loss of integrity within the the vulnerable server. However, it is possible to subsequently discover another vulnerability via the revealed source code . There is no immediate impact to availability of the vulnerable server. However, the presence of an unsafe regular expression, for example, can quickly be exploited to subsequently compromise the availability. The fix for **server-output** projects was released in **astro@5.0.8**, and the fix for **static-output** projects was released in **astro@5.0.9** and backported to Astro v4 in **astro@4.16.18**. Users are advised to update immediately if they are using sourcemaps or an integration that enables sourcemaps.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V13.2.4
Mitigating Controls (NIST 800-53 r5) AI
AC-3 directly enforces logical access authorizations on resources, stopping unauthorized parties from reaching sensitive files stored under the web root.
AC-6 limits granted privileges to the minimum needed, reducing the chance that web-accessible paths expose sensitive data.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing least-privilege access permissions directly prevents unauthorized retrieval of sensitive files stored under the web root.
Protecting confidentiality of data-at-rest mitigates exposure of files that should never have been placed under the web root.
Hardened configuration baselines and change control prevent placement of sensitive files in publicly served directories.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure architecture principles discourage storing sensitive data in publicly served directories.
Technical access restrictions can block direct HTTP access to sensitive files under the web root.
Classification identifies sensitive data so it can be placed outside the web root.
Access-control policy defines who may reach files under the web root.
Granting only the minimum rights prevents unauthorized retrieval of sensitive files.
Secure SDLC practices include placing sensitive data outside the document root.