CVE-2025-31137

Executive Summary

CVE-2025-31137 is a critical URL spoofing vulnerability affecting Remix 2 and React Router 7 applications using the Express adapter. The flaw allows an attacker to manipulate the Host or X-Forwarded-Host HTTP header by embedding a URL pathname within the port field (e.g., Host: legitimate.com:443/evil-path). This causes the Express adapter to construct a malformed Request object, enabling the attacker to spoof the request URL and potentially bypass security controls, redirect users, or perform server-side request forgery (SSRF). The vulnerability has been patched in Remix 2.16.3 and React Router 7.4.1. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability affects the @remix-run/express and react-router-express npm packages. Organizations using these packages should immediately audit their dependency trees and update to the patched versions. The attack vector is network-based and requires no authentication, making it a high-priority fix for any exposed Remix or React Router application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: High (I:H)
• Availability Impact: None (A:N)

The high integrity impact stems from the attacker's ability to manipulate the request URL, which can lead to unauthorized actions, data manipulation, or redirection to malicious sites.

Deep Dive & Mechanics

The vulnerability resides in the Express adapter's request handling logic. When a request arrives, the adapter constructs a Request object using the Host or X-Forwarded-Host header to determine the base URL. The flaw occurs because the adapter does not properly sanitize the port portion of the header. An attacker can inject a pathname into the port field, e.g.:

Host: example.com:443/evil-path

The adapter parses this as a valid host:port combination, but the /evil-path portion is interpreted as part of the URL path. This results in a Request object where the URL is http://example.com:443/evil-path/actual-request-path, effectively spoofing the original request URL.

This can be exploited to:

• Bypass URL-based access controls.
• Perform open redirect attacks.
• Manipulate server-side logic that relies on the request URL.
• In some configurations, enable SSRF if the application uses the request URL to make outbound connections.

Vulnerable vs. Patched Code

Vulnerable Code (Remix < 2.16.3 / React Router < 7.4.1):

// Express adapter request creation
function createRequest(req, res) {
  const host = req.headers['x-forwarded-host'] || req.headers.host;
  const url = new URL(req.url, `http://${host}`);
  return new Request(url, { method: req.method, ... });
}

The issue is that new URL(req.url, base) will treat any path in the host variable as part of the base URL, leading to URL spoofing.

Patched Code (Remix 2.16.3 / React Router 7.4.1):

// Patched Express adapter request creation
function createRequest(req, res) {
  const host = req.headers['x-forwarded-host'] || req.headers.host;
  // Validate host header to ensure it contains only host:port
  if (host && !/^[a-zA-Z0-9.-]+(:[0-9]+)?$/.test(host)) {
    throw new Error('Invalid Host header');
  }
  const url = new URL(req.url, `http://${host}`);
  return new Request(url, { method: req.method, ... });
}

The patch adds a validation regex that ensures the host header contains only a valid hostname and optional numeric port, rejecting any injected path components.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy a vulnerable Remix 2.16.2 application with the Express adapter.
2. Craft Payload: Send a request with a manipulated Host header:

   GET /protected/resource HTTP/1.1
   Host: legitimate-app.com:443/evil-redirect
   

3. Observe: The application will process the request as if it originated from http://legitimate-app.com:443/evil-redirect/protected/resource, potentially bypassing access controls or triggering a redirect.

Example curl command:

curl -H "Host: target.com:443/evil-path" http://vulnerable-server.com/some-endpoint

Blue Team (Detection & Defense)

1. Monitor Host Headers: Deploy WAF rules to detect and block requests with path components in the Host or X-Forwarded-Host header.
2. Validate Headers: Implement middleware to validate the format of incoming host headers before they reach the application.
3. Update Immediately: Apply the patch by upgrading to Remix 2.16.3+ or React Router 7.4.1+.

Detection Script (Node.js):

// Middleware to detect malicious host headers
app.use((req, res, next) => {
  const host = req.headers['x-forwarded-host'] || req.headers.host;
  if (host && !/^[a-zA-Z0-9.-]+(:[0-9]+)?$/.test(host)) {
    console.warn(`Suspicious host header detected: ${host}`);
    return res.status(400).send('Bad Request');
  }
  next();
});

Indicators of Compromise (IOCs)

• Network: HTTP requests with Host or X-Forwarded-Host headers containing path components (e.g., Host: example.com:443/evil).
• Logs: Application logs showing unexpected URL paths or redirects.
• File System: No specific file-based IOCs.
• Registry: No registry-based IOCs.

Example suspicious log entry:

GET /admin HTTP/1.1
Host: legitimate.com:443/../../evil

Detection Engineering

YARA Rule

rule CVE_2025_31137_Host_Header_Spoofing {
    meta:
        description = "Detects malicious Host headers attempting to exploit CVE-2025-31137"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-31137"
    strings:
        $host_pattern = /Host:\s*[a-zA-Z0-9.-]+:\d+\/[^\r\n]+/i
        $x_forwarded_pattern = /X-Forwarded-Host:\s*[a-zA-Z0-9.-]+:\d+\/[^\r\n]+/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-31137 - Host Header Path Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with path components in Host or X-Forwarded-Host headers
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        - http.request.headers.host|contains: "/"
        - http.request.headers.x-forwarded-host|contains: "/"
    condition: selection
falsepositives:
    - Legitimate use of port numbers with trailing slashes (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-31137 - Host Header Path Injection Attempt";
    flow:to_server;
    content:"Host|3a|"; nocase;
    pcre:"/Host:\s*[a-zA-Z0-9.-]+:\d+\/[^\r\n]+/i";
    sid:10000001;
    rev:1;
    reference:cve,2025-31137;
)

Remediation & Mitigation

1. Immediate Patch: Upgrade to Remix 2.16.3 or React Router 7.4.1.
2. WAF Rules: Deploy web application firewall rules to block requests with path components in host headers.
3. Input Validation: Implement server-side validation of the Host and X-Forwarded-Host headers.
4. Network Segmentation: Ensure that the application is not directly exposed to the internet if possible.
5. Monitoring: Enable logging and alerting for suspicious host header patterns.

Valters IT Senior DevSecOps & Cyber Threat Intelligence Expert