Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems

Summary

The /_image endpoint used by the @astrojs/node adapter checks that a requested local image is inside the build output directory before reading it from disk. That check compared paths case-insensitively. On case-sensitive filesystems (such as Linux), a directory whose path differs from the output directory only by letter case is a different directory, but it passed the check.

For example, with the client output directory at /srv/app/dist/client/, a request such as:

/_image?href=/../../DIST/client/secret.png&w=32&f=png

resolved to /srv/app/DIST/client/secret.png and was served, even though that file is outside the output directory.

Impact

An unauthenticated attacker can read image files from outside the output directory, but only when all of the following are true:

• The site uses on-demand rendering with the @astrojs/node adapter.
• The server runs on a case-sensitive filesystem.
• A directory exists whose path matches the output directory except for letter case (for example DIST/client next to dist/client). Such a layout is unusual, and the attacker cannot create it.

Only files the image service accepts can be read. Raster images are returned after resizing; SVG files are returned unchanged. Other file types fail during processing. Plain path traversal outside the output directory (for example /../../secret.png) was already rejected and is not affected.

Affected versions

astro >= 5.14.3, <= 7.4.6, when used with @astrojs/node (all versions up to 11.1.11). The vulnerable image endpoint is provided by astro and used by the @astrojs/node adapter.

Patches

Fixed in astro 7.4.7. The path check now compares paths exactly, and only ignores letter case for Windows drive-letter paths. The fix ships in astro, so upgrading @astrojs/node alone is not enough.

Workarounds

Upgrade to astro 7.4.7 or later. Before upgrading, make sure no directory next to the build output directory has a path that differs from it only by letter case.

Credits

Reported by @zachariah-mithani.