CVE-2025-61925

Executive Summary

CVE-2025-61925 is a URL redirection vulnerability in the Astro web framework, affecting versions prior to 5.14.2. The flaw allows an attacker to manipulate the Astro.url object by injecting a malicious X-Forwarded-Host header. When a web server (e.g., nginx) is configured to forward requests using the Host header, an attacker can send a request with both a legitimate Host header and a malicious X-Forwarded-Host header. Astro will then reflect the malicious value in the output, potentially leading to open redirect attacks. This is particularly dangerous when combined with caching proxies, as the malicious redirect could be cached and served to subsequent users. The vulnerability has a CVSS score of 6.5 (Medium) and is classified as CWE-601 (URL Redirection to Untrusted Site).

Supply Chain & Package Security

Astro is distributed via npm. Users should update to version 5.14.2 or later. The package integrity can be verified using npm's built-in integrity checks (e.g., npm audit or npm ci). No malicious packages have been reported in the supply chain related to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The threat level is considered Medium due to the low complexity and the potential for cache poisoning, which can amplify the impact to multiple users.

Deep Dive & Mechanics

The vulnerability stems from Astro's handling of the X-Forwarded-Host header. In a typical deployment, a reverse proxy (e.g., nginx) forwards requests to the Astro server. The proxy sets the X-Forwarded-Host header to the original Host header from the client. However, if an attacker sends a request with a malicious X-Forwarded-Host header, Astro will use that value to construct Astro.url without validation.

Attack Flow:

1. Attacker sends a request to the Astro server with:
   • Host: legitimate-site.com
   • X-Forwarded-Host: malicious-site.com
2. The reverse proxy forwards the request, preserving the malicious X-Forwarded-Host.
3. Astro's Astro.url returns a URL based on the malicious header.
4. If the application uses Astro.url for a canonical link, login form action, or redirect, the user is redirected to the attacker's site.

Impact with Caching: If a caching proxy is in use, the malicious response may be cached. Subsequent users requesting the same page will receive the cached response, redirecting them to the attacker's site.

Vulnerable vs. Patched Code

Vulnerable Code (Astro < 5.14.2):

// In Astro's internal URL construction
const url = new URL(request.url);
// Uses X-Forwarded-Host directly without validation
const host = request.headers.get('X-Forwarded-Host') || request.headers.get('Host');
url.host = host;

Patched Code (Astro >= 5.14.2):

// In Astro's internal URL construction
const url = new URL(request.url);
const forwardedHost = request.headers.get('X-Forwarded-Host');
const host = request.headers.get('Host');
// Validate that forwarded host matches the expected host or is in an allowlist
if (forwardedHost && forwardedHost !== host) {
  // Reject or sanitize the header
  throw new Error('Invalid X-Forwarded-Host header');
}
url.host = host;

Exploitation & Lab Setup

Red Team

Prerequisites:

• Astro application running in on-demand/dynamic rendering mode.
• Reverse proxy (e.g., nginx) configured to forward X-Forwarded-Host.

Exploitation Steps:

1. Identify an endpoint that uses Astro.url (e.g., canonical link, form action).
2. Send a crafted request:

   curl -H "Host: example.com" -H "X-Forwarded-Host: attacker.com" http://target-astro-app/page
   

3. Observe that the response contains a redirect or link to attacker.com.

Example Payload:

GET /login HTTP/1.1
Host: example.com
X-Forwarded-Host: attacker.com

Blue Team

Detection:

• Monitor for requests with mismatched Host and X-Forwarded-Host headers.
• Check server logs for unusual redirect patterns.

Mitigation:

• Update Astro to version 5.14.2 or later.
• Configure the reverse proxy to strip or validate X-Forwarded-Host headers.
• Implement an allowlist of valid hostnames in the application.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with mismatched Host and X-Forwarded-Host headers.
  • Responses containing redirects to unexpected domains.
• Log IOCs:
  • Server logs showing X-Forwarded-Host values that differ from the Host header.
  • Cached responses with malicious redirects.

Detection Engineering

YARA Rule

rule CVE_2025_61925_Astro_Header_Injection {
    meta:
        description = "Detects Astro responses with mismatched Host and X-Forwarded-Host headers"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61925"
    strings:
        $header_pattern = /X-Forwarded-Host:\s*[^\r\n]+/ nocase
        $host_pattern = /Host:\s*[^\r\n]+/ nocase
    condition:
        #header_pattern and #host_pattern and
        for any i in (1..#header_pattern):
            for any j in (1..#host_pattern):
                (header_pattern[i] != host_pattern[j])
}

Sigma Rule

title: CVE-2025-61925 - Astro X-Forwarded-Host Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with mismatched Host and X-Forwarded-Host headers targeting Astro applications.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '*'
        cs-host: '*'
        cs-headers:
            - 'X-Forwarded-Host:*'
    condition: selection and not (cs-host == cs-headers['X-Forwarded-Host'])
falsepositives:
    - Legitimate proxy configurations where headers differ intentionally.
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-61925 - Astro X-Forwarded-Host Injection"; flow:to_server; content:"X-Forwarded-Host"; http_header; pcre:"/X-Forwarded-Host:\s*[^\r\n]+/i"; pcre:"/Host:\s*[^\r\n]+/i"; pcre:"/^(?!.*Host:\s*[^\r\n]+\s*X-Forwarded-Host:\s*\1)/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Astro to version 5.14.2 or later.
2. If immediate update is not possible, configure the reverse proxy to strip the X-Forwarded-Host header or validate it against the Host header.
3. Implement an allowlist of valid hostnames in the application code.

Long-term Measures:

• Regularly update dependencies and monitor for security advisories.
• Use a Web Application Firewall (WAF) to detect and block header injection attempts.
• Conduct regular security audits and penetration testing.

Valters IT signature:

This report was generated by Valters IT Cyber Threat Intelligence Division.