CVE-2026-73423

Executive Summary

CVE-2026-73423 is a blind, write-only cross-site request forgery (CSRF) vulnerability affecting Astro's composable astro/hono pipeline in versions 7.0.0 through 7.0.5. Applications that mount actions() or pages() without a preceding middleware() — or that mount actions() before middleware() — can dispatch user code before Astro's security.checkOrigin validation executes, allowing a malicious website to submit cross-origin form-encoded requests using the victim's cookies and trigger state-mutating handlers. The default non-composable astro() pipeline is not affected; the issue is fixed in Astro 7.0.6.

Technical Analysis

Astro's composable astro/hono pipeline exposes three independent primitives — middleware(), actions(), and pages() — which the developer composes manually. In the default monolithic astro() pipeline, the framework applies security.checkOrigin as part of its integrated request lifecycle. In the composable pipeline, however, security.checkOrigin is installed only through the middleware() primitive. This creates a critical ordering and composition dependency:

• If actions() is mounted before middleware(), incoming cross-origin requests that target the actions handler are routed to user code before the origin check has an opportunity to run. This is the exact configuration shown in Astro's examples/advanced-routing example and in the Cloudflare Hono documentation.
• If pages() is used without middleware() entirely, on-demand endpoints and pages are handled without any origin validation.
• The vulnerable dispatch paths are ActionHandler.handle and PagesHandler.handleWithErrorFallback, which execute when manifest.checkOrigin is enabled but bypassed due to the faulty composition.

The resulting flaw is a blind write-only CSRF (CWE-352). The attacker can trigger a state-mutating action or endpoint handler using the victim's authenticated cookies, but the Same-Origin Policy prevents the attacker from reading the cross-origin response. Consequently, the attack is suited to write-only business operations (profile changes, settings toggles, resource creation, deletion, or other state mutations) rather than data exfiltration. No CVSS vector has been assigned (score N/A), and the EPSS score is low (0.00182, 8.1st percentile of exploited CVEs), indicating no widespread in-the-wild exploitation is currently observed. The OSV advisory lists the package as affected with an unfixed commit reference; the vendor's fix is claimed in version 7.0.6, though this is a single-source claim (Patch Confidence 2/4).

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification: The attacker identifies Astro 7.0.x applications that expose Hono-based composable routing, on-demand endpoints, or server actions. Fingerprinting options include framework-generated HTML markers, X-Powered-By style headers, or behavioral probing of POST handling. The attacker specifically looks for applications where state-mutating functionality is reachable via actions() or pages() and where session cookies are sent on cross-origin requests.

2. Triggering the flaw: The attacker hosts a malicious web page containing an auto-submitting HTML <form> that performs a POST with application/x-www-form-urlencoded encoding to a target URL on the victim application. When the victim visits the attacker's page, the browser issues a cross-origin form submission and includes the victim's cookies for the target origin. Because security.checkOrigin was bypassed (either actions() mounted before middleware(), or pages() used without middleware()), the request reaches ActionHandler.handle or PagesHandler.handleWithErrorFallback without origin validation.

3. Payload / execution method: The form payload uses hidden fields to mimic the expected parameters of the vulnerable action or endpoint. The attacker cannot read the response and therefore relies on the blind side-effect of the handler — e.g., modifying an account setting, creating or deleting a resource, or triggering any state-mutating business logic. The attack requires the victim to be authenticated to the target application and to click through / load the attacker's page.

4. Post-exploitation impact: Successful exploitation results in unauthorized state changes on the victim's account or the application's data. Because the CSRF is write-only, the attacker cannot directly steal confidential data via this vector, but the write primitive can be chained with other defects (e.g., stored XSS, business-logic flaws) to escalate to account takeover or data compromise. In the worst case, destructive actions (e.g., deletion) can be performed without user interaction beyond a single page visit.

Impact Assessment

• Affected systems: Astro 7.0.0 – 7.0.5 applications built on the composable astro/hono pipeline. The default astro() pipeline is explicitly not affected.
• Business impact: Integrity impact is the primary concern — unauthorized state mutation via authenticated sessions. Confidentiality impact is negligible from this vulnerability alone due to the blind/write-only nature. Availability impact may occur if the vulnerable handler supports destructive operations.
• CVSS: No official score or vector is assigned (N/A). EPSS (0.00182, 8.1 percentile) suggests a low current probability of exploitation in the wild. CISA KEV does not list this CVE.
• Blast radius: Limited to composable-pipeline deployments and to applications relying on cookie-based session authentication without additional CSRF defenses (e.g., SameSite cookies, CSRF tokens). The misconfiguration documented in Astro's own example and Cloudflare's Hono documentation widens the practical exposure because it represents a "blessed" pattern that developers may copy verbatim.

Detection Guidance

The rules below detect CSRF-class behavior generically, since the vulnerable endpoints are application-specific. Administrators should instrument access logs to capture Origin and Referer headers, as common access-log formats omit them.

Sigma Rule

title: Blind CSRF Attempt Against Astro Composable Pipeline (CVE-2026-73423)
id: 4e8b9d2a-b8c1-4f7e-9e3a-6c91d4f2aa71
status: experimental
description: Detects cross-origin form-encoded HTTP POST requests to Astro-managed applications that lack an Origin header, consistent with blind write-only CSRF against the composable astro/hono pipeline.
logsource:
  category: webserver
  product: generic
detection:
  selection_method:
    cs-method: POST
  selection_type:
    http.content_type: application/x-www-form-urlencoded
  selection_missing_origin:
    cs-origin: null
  filter_same_origin:
    cs-origin|contains: "example.com"
  condition: selection_method and selection_type and selection_missing_origin and not filter_same_origin
level: medium
tags:
  - attack.t1189
  - cwe.352
  - cve.2026-73423

YARA Rule

rule astro_blind_csrf_autosubmit_form
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects malicious HTML payloads that auto-submit cross-origin form-encoded POST forms, a delivery pattern for CVE-2026-73423 blind CSRF"
        reference = "CVE-2026-73423"
        cwe = "CWE-352"
        date = "2026-01-01"
    strings:
        $form = "<form"
        $method = "method=\"post\"" nocase
        $enctype = "enctype=\"application/x-www-form-urlencoded\"" nocase
        $submit_js = /document\.forms\[[^\]]*\]\.submit\(\)/i
        $submit_js2 = /\.submit\(\)\s*;?/i
        $onload = /onload\s*=\s*["'][^"']*submit/i
    condition:
        $form and $method and $enctype and 1 of ($submit_js, $submit_js2, $onload)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET WEB Astro Composable Pipeline Blind CSRF Attempt (POST, No Origin)"; flow:established,to_server; http.method; content:"POST"; http.content_type; content:"application/x-www-form-urlencoded"; http.header_names; content:"!Origin"; nocase; http.header_names; content:"Content-Type"; sid:20267342; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-73423;)

alert http any any -> $HOME_NET any (msg:"ET WEB Astro Composable Pipeline Blind CSRF Attempt (Origin null)"; flow:established,to_server; http.method; content:"POST"; http.content_type; content:"application/x-www-form-urlencoded"; http.origin; content:"null"; nocase; sid:20267343; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-73423;)

Elastic Detection

any where event.category == "web" and http.request.method == "POST"
  and http.request.content_type == "application/x-www-form-urlencoded"
  and (http.request.origin == null or http.request.origin == "null"
       or not startsWith(http.request.origin, url.domain))

Splunk SPL Query

index=web sourcetype=access_combined
  cs_method=POST
  http_content_type="application/x-www-form-urlencoded"
| eval has_origin=if(isnull(cs_origin),0,1), has_referer=if(isnull(cs_referer),0,1)
| eval origin_host=lower(replace(cs_origin,"^https?://([^/:]+).*","\1")),
         referer_host=lower(replace(cs_referer,"^https?://([^/:]+).*","\1")),
         request_host=lower(replace(host,"^([^/:]+).*","\1"))
| eval cross_origin=if((has_origin==1 AND origin_host!=request_host) OR (has_origin==0 AND has_referer==0), 1, 0)
| where cross_origin==1
| stats count by clientip, host, cs_uri_stem, cs_origin, cs_referer
| sort - count

Wazuh OSSEC Rule

<group name="apache,web,csrf,">
  <rule id="100345" level="10">
    <if_sid>31100</if_sid>
    <field name="method">POST</field>
    <regex>application/x-www-form-urlencoded</regex>
    <description>Astro blind CSRF (CVE-2026-73423): form-encoded POST with no Origin/Referer in access log</description>
    <group>cve-2026-73423,cwe-352,attack.t1189,</group>
  </rule>
</group>

Note: The Wazuh rule assumes an Apache-style access log decoder that populates method and the raw request line. If Origin/Referer are not present in your access logs, deploy a custom decoder or proxy instrumentation, because their absence is the key CSRF indicator.

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED) — the fix is asserted by a single source (OSV) and is not independently confirmed. Verify the fix against Astro's official release notes before treating 7.0.6 as authoritative.

1. Immediate mitigations:

   • In any composable astro/hono deployment, ensure middleware() (which installs security.checkOrigin) is mounted before both actions() and pages(). Never use pages() without an accompanying middleware().
   • Review all deployments copied from examples/advanced-routing or the Cloudflare Hono documentation; these are known to reproduce the vulnerable ordering.
   • Enforce Origin/Referer validation at the reverse proxy or load balancer for all state-changing POST requests.
   • Set SameSite=Lax or SameSite=Strict on session cookies to neutralize most CSRF scenarios. Where SameSite cannot be applied, require an explicit CSRF token on all mutating actions.

2. Patch / upgrade steps:

   • Upgrade Astro to 7.0.6 or later in all affected environments.
   • Validate the patched behavior by sending a cross-origin form-encoded POST to a test action and confirming that security.checkOrigin rejects it.
   • Track the OSV advisory (reference f55ba4caca7c587555da86e3211ae1f1b3407c5f) until the patch claim is independently confirmed by the vendor.

3. Long-term hardening:

   • Prefer the default non-composable astro() pipeline where composability is not strictly required; the default pipeline is unaffected.
   • Add defense-in-depth: CSRF tokens on all state-changing endpoints, strict Origin checks in application middleware, and Referrer-Policy headers.
   • Monitor Astro security advisories and CISA KEV for updates; while this CVE is not currently listed in KEV, EPSS and threat-actor interest should be re-evaluated periodically.

References

1. NVD — CVE-2026-73423: https://nvd.nist.gov/vuln/detail/CVE-2026-73423
2. OSV Advisory — CVE-2026-73423: https://osv.dev/vulnerability/CVE-2026-73423
3. Astro Security & Release Notes (verify 7.0.6 fix): https://astro.build/security
4. Astro Hono integration / composable pipeline documentation (contains the vulnerable mounting pattern): https://docs.astro.build/en/guides/integrations-guide/hono/
5. CISA Known Exploited Vulnerabilities Catalog — CVE-2026-73423 is not listed; no known threat-actor campaigns or exploit-in-the-wild evidence were identified at the time of writing.