PT-2025-32332 · Astro · Astro
Ghiyastfarisi
·
Publicado
2025-08-07
·
Atualizado
2026-03-25
·
CVE-2025-54793
CVSS v4.0
6.9
Média
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
Name of the Vulnerable Software and Affected Versions
Astro versions 5.2.0 through 5.12.7
Description
Astro is susceptible to an Open Redirect vulnerability stemming from improper handling of paths containing double slashes in its trailing slash redirection logic. This allows an attacker to redirect users to arbitrary external domains via crafted URLs, potentially leading to phishing and social engineering attacks. The vulnerability affects sites utilizing on-demand rendering (SSR) with the Node or Cloudflare adapters, but does not impact static sites or those deployed to Netlify or Vercel. The issue arises because the application uses a relative path for the redirect, and when the target path starts with
//, the browser interprets it as a protocol-relative URL, resulting in redirection to a malicious domain. The URL needed to trigger the vulnerability varies according to the trailingSlash setting.Recommendations
Astro version 5.12.8 resolves this issue.
Upgrade to Astro version 5.12.8.
As a temporary workaround, block outgoing redirect responses with a
Location header value that starts with // at the network level.Exploit
Correção
Open Redirect
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Astro