# CVE-2024-56159: Astro - Information Disclosure

> Live exploitation tracking for CVE-2024-56159 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-56159

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 7.8
- **Public exploit available:** Yes
- **Affected products:** WithAstro Astro
- **Weaknesses:** CWE-219 (Storage of File with Sensitive Data Under Web Root)
- **Tags:** web_application, javascript

## Description

Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. During build, along with client assets such as css and font files, the sourcemap files **for the server code** are moved to a publicly-accessible folder. Any outside party can read them with an unauthorized HTTP GET request to the same server hosting the rest of the website. While some server files are hashed, making their access obscure, the files corresponding to the file system router (those in `src/pages`) are predictably named. For example. the sourcemap file for `src/pages/index.astro` gets named `dist/client/pages/index.astro.mjs.map`. This vulnerability is the root cause of issue #12703, which links to a simple stackblitz project demonstrating the vulnerability. Upon build, notice the contents of the `dist/client` (referred to as `config.build.client` in astro code) folder. All astro servers make the folder in question accessible to the public internet without any authentication. It contains `.map` files corresponding to the code that runs on the server. All **server-output** projects on Astro 5 versions **v5.0.3** through **v5.0.7**, that have **sourcemaps enabled**, either directly or through an add-on such as `sentry`, are affected. The fix for **server-output** projects was released in **astro@5.0.8**. Additionally, all **static-output** projects built using Astro 4 versions **4.16.17 or older**, or Astro 5 versions **5.0.8 or older**, that have **sourcemaps enabled** are also affected. The fix for **static-output** projects was released in **astro@5.0.9**, and backported to Astro v4 in **astro@4.16.18**. The immediate impact is limited to source code. Any secrets or environment variables are not exposed unless they are present verbatim in the source code. There is no immediate loss of integrity within the the vulnerable server. However, it is possible to subsequently discover another vulnerability via the revealed source code . There is no immediate impact to availability of the vulnerable server. However, the presence of an unsafe regular expression, for example, can quickly be exploited to subsequently compromise the availability. The fix for **server-output** projects was released in **astro@5.0.8**, and the fix for **static-output** projects was released in **astro@5.0.9** and backported to Astro v4 in **astro@4.16.18**. Users are advised to update immediately if they are using sourcemaps or an integration that enables sourcemaps.

## CrowdSec analysis

[CVE-2024-56159](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-56159) is an information disclosure vulnerability in the Astro web framework that allows unauthenticated users to access server-side source code via exposed sourcemap files. By exploiting this flaw, attackers can retrieve sensitive implementation details, potentially aiding in the discovery of further vulnerabilities or weaknesses in the application. While the immediate risk is limited to source code exposure and does not directly reveal secrets or impact server integrity or availability, the leaked information could be leveraged for more targeted attacks. Users of affected Astro versions with sourcemaps enabled are strongly advised to update to the latest patched releases.

CrowdSec has been tracking this vulnerability and its exploits since 11th of February 2026.

CrowdSec network data shows that most actors exploiting CVE-2024-56159 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2024-56159 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers attempt to access publicly exposed sourcemap files such as `/pages/index.astro.mjs.map` or `/index.astro.mjs.map` to disclose server source code, targeting Astro deployments with sourcemaps enabled.

## Timeline

- 2024-12-19: CVE Published. CVE-2024-56159 is published to NVD.
- 2026-02-11: Rule Released. CrowdSec releases a rule to detect CVE-2024-56159 exploitation attempts against the CrowdSec Network.
- 2026-02-11: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-56159 for the first time.

## References

- https://github.com/withastro/astro/security/advisories/GHSA-49w6-73cw-chjr
- https://github.com/withastro/astro/blob/176fe9f113fd912f9b61e848b00bbcfecd6d5c2c/packages/astro/src/core/build/static-build.ts#L139
- https://github.com/withastro/astro/issues/12703
- https://github.com/getsentry/sentry-javascript/blob/develop/packages/astro/src/integration/index.ts#L50
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-56159.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-56159) follows observed exploitation activity for CVE-2024-56159. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.