CVE-2025-54793

Executive Summary

CVE-2025-54793 is an open redirect vulnerability in the Astro web framework, affecting versions 5.2.0 through 5.12.7. The flaw resides in the trailing slash redirection logic when handling paths with double slashes. An attacker can craft a URL such as https://mydomain.com//malicious-site.com/ to redirect users to arbitrary external domains. This vulnerability only impacts sites using on-demand rendering (SSR) with the Node or Cloudflare adapters. Static sites or those deployed to Netlify or Vercel are not affected. The vulnerability has a CVSS score of 6.1 (Medium) and is classified under CWE-601 (URL Redirection to Untrusted Site). A public proof-of-concept exists via a Nuclei template, and the patch is available in version 5.12.8.

Supply Chain & Package Security

Astro is an npm package. The vulnerability affects the core server-side rendering logic. Users should verify their package.json for Astro version and update to the latest patched version. No malicious packages have been associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) - The user must click a crafted link.
• Scope: Changed (S:C) - The redirect can lead to a different security domain.
• Confidentiality Impact: Low (C:L) - Potential information disclosure via phishing.
• Integrity Impact: Low (I:L) - The redirect can modify user-visible content.
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires user interaction but can be exploited without authentication. The primary risk is phishing and social engineering.

Deep Dive & Mechanics

The vulnerability exists in Astro's server-side rendering (SSR) middleware that handles trailing slash redirection. When a request is made to a URL with double slashes (e.g., //evil.com), the server incorrectly interprets the path as a protocol-relative URL and issues a redirect with a Location header starting with //. This causes the browser to navigate to the external domain specified after the double slashes.

Root Cause: The trailing slash redirection logic does not sanitize or validate the path before constructing the redirect URL. It treats the double slash as part of the path rather than a potential protocol-relative redirect.

Affected Components:

• @astrojs/node (Node adapter)
• @astrojs/cloudflare (Cloudflare adapter)

Not Affected:

• Static site generation (SSG)
• Netlify adapter
• Vercel adapter

Vulnerable vs. Patched Code

Vulnerable Code (Astro < 5.12.8): The vulnerable code likely resides in the server-side request handler that constructs redirect URLs. A simplified representation:

// Vulnerable: Directly uses the request path for redirect
function handleTrailingSlash(req, res) {
  let path = req.url;
  // ... some logic to add trailing slash ...
  res.writeHead(302, { 'Location': path });
  res.end();
}

Patched Code (Astro >= 5.12.8): The patch sanitizes the path to prevent protocol-relative redirects.

// Patched: Sanitize path to prevent open redirect
function handleTrailingSlash(req, res) {
  let path = req.url;
  // Sanitize: Remove leading double slashes
  path = path.replace(/^\/\//, '/');
  // ... rest of logic ...
  res.writeHead(302, { 'Location': path });
  res.end();
}

The actual commit (9ec88a04f93611cc07deff76ef6a18c88d6a77b9) implements similar sanitization.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Astro 5.2.0 to 5.12.7 with SSR enabled using Node or Cloudflare adapter.
• Attacker-controlled domain (e.g., evil.com).

Exploit Steps:

1. Craft a malicious URL: https://victim.com//evil.com/
2. Send the URL to a victim via email, social media, or other channels.
3. When the victim clicks the link, the Astro server responds with a 302 redirect to //evil.com/.
4. The browser interprets //evil.com/ as https://evil.com/ (protocol-relative), redirecting the user to the attacker's site.

Example using curl:

curl -v "https://victim.com//evil.com/"

Expected Response:

HTTP/1.1 302 Found
Location: //evil.com/

Blue Team

Detection:

• Monitor server logs for requests containing double slashes in the path (e.g., //).
• Look for 302/301 responses with Location headers starting with //.
• Use the provided Nuclei template for scanning.

Mitigation:

• Immediately upgrade to Astro 5.12.8 or later.
• If upgrade is not possible, implement a network-level WAF rule to block outgoing redirects with Location headers starting with //.

WAF Rule Example (ModSecurity):

SecRule RESPONSE_HEADERS:Location "^//" "id:1001,phase:3,deny,status:403,msg:'Open Redirect Attempt Blocked'"

Indicators of Compromise (IOCs)

• URL Pattern: https://<victim-domain>//<attacker-domain>/
• HTTP Response: 301, 302, 307, or 308 redirect with Location header starting with //
• Server Logs: Requests with double slashes in the path (e.g., GET //evil.com/ HTTP/1.1)
• Referer Header: May contain the malicious URL if the victim clicks from a phishing email.

Detection Engineering

YARA Rule

rule CVE_2025_54793_Astro_Open_Redirect {
    meta:
        description = "Detects Astro open redirect attempts via double slashes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-54793"
        hash = "490a004630440220186e0aee6c9a3f95ee44a72a6164c113f8380d6a37d54179cc9747525a335cdd0220524e9530af817abf4c8d06f4689e375095144fadc96acec3e38cae9c78442d08"
    strings:
        $redirect_header = /Location:\s*\/\// nocase
        $double_slash_path = /GET\s+\/\/[a-zA-Z0-9.-]+\// nocase
    condition:
        any of them
}

Sigma Rule

title: Astro Open Redirect via Double Slashes
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects HTTP responses with Location header starting with // indicating potential CVE-2025-54793 exploitation
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54793
    - https://github.com/withastro/astro/security/advisories/GHSA-cq8c-xv66-36gw
logsource:
    category: webserver
    product: generic
detection:
    selection:
        response.status: [301, 302, 307, 308]
        response.headers.Location|startswith: "//"
    condition: selection
falsepositives:
    - Legitimate protocol-relative URLs (rare in modern web)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54793 Astro Open Redirect Attempt"; flow:to_server; content:"GET"; http_method; content:"//"; http_uri; distance:0; pcre:"/^\/\//"; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template

id: CVE-2025-54793

info:
  name: Astro SSR - Open Redirect
  author: DhiyaneshDk
  severity: medium
  description: |
    Astro 5.2.0 through 5.12.7 contains an open redirect caused by improper handling of paths with double slashes in trailing slash redirection logic, letting attackers redirect users to arbitrary external domains, exploit requires on-demand SSR with Node or Cloudflare adapters.
  impact: |
    Attackers can redirect users to malicious sites, increasing phishing and social engineering risks.
  remediation: |
    Upgrade to version 5.12.8 or later; alternatively, block outgoing redirects with Location headers starting with // at the network level.
  reference:
    - https://github.com/withastro/astro/security/advisories/GHSA-cq8c-xv66-36gw
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54793
    - https://github.com/withastro/astro/commit/9ec88a04f93611cc07deff76ef6a18c88d6a77b9
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2025-54793
    epss-score: 0.00959
    epss-percentile: 0.7656
    cwe-id: CWE-601
  metadata:
    verified: true
    max-request: 3
    vendor: withastro
    product: astro
    shodan-query: http.component:"Astro"
    fofa-query: app="Astro"
  tags: cve,cve2025,astro,redirect,open-redirect

http:
  - method: GET
    path:
      - "{{BaseURL}}//interact.sh/en//"
      - "{{BaseURL}}//interact.sh/en/"
      - "{{BaseURL}}//interact.sh/en"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 301
          - 302
          - 307
          - 308

      - type: regex
        part: header
        regex:
          - '(?i)location:\s*//interact\.sh'

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Astro to version 5.12.8 or later using npm update astro or yarn upgrade astro.
2. Network-Level Workaround: If upgrade is not possible, configure a WAF or reverse proxy to block outgoing redirect responses with Location headers starting with //.

Long-Term Measures:

• Implement input validation for all redirect URLs.
• Use a whitelist of allowed redirect destinations.
• Regularly audit dependencies for known vulnerabilities.

Verification:

• After patching, test with the Nuclei template to confirm the vulnerability is resolved.
• Monitor logs for any residual exploitation attempts.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 0800BB72CC9ECF24F33E14BF] */}