| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| astro | ≥ 5.2.0, < 5.12.7 | 5.12.7 |
| astro | ≥ 5.2.0, < 5.12.8 | 5.12.8 |
There is an Open Redirection vulnerability in the trailing slash redirection logic when handling paths with double slashes. This allows an attacker to redirect users to arbitrary external domains by crafting URLs such as https://mydomain.com//malicious-site.com/. This increases the risk of phishing and other social engineering attacks.
This affects Astro >=5.2.0 sites that use on-demand rendering (SSR) with the Node or Cloudflare adapter. It does not affect static sites, or sites deployed to Netlify or Vercel.
Astro performs automatic redirection to the canonical URL, either adding or removing trailing slashes according to the value of the trailingSlash configuration option. It follows the following rules:
trailingSlash is set to "never", https://example.com/page/ will redirect to https://example.com/pagetrailingSlash is set to "always", https://example.com/page will redirect to https://example.com/page/It also collapses multiple trailing slashes, according to the following rules:
trailingSlash is set to "always" or "ignore" (the default), https://example.com/page// will redirect to https://example.com/page/trailingSlash is set to "never", https://example.com/page// will redirect to https://example.com/pageIt does this by returning a 301 redirect to the target path. The vulnerability occurs because it uses a relative path for the redirect. To redirect from https://example.com/page to https://example.com/page/, it sending a 301 response with the header Location: /page/. The browser resolves this URL relative to the original page URL and redirects to https://example.com/page/
The vulnerability occurs if the target path starts with //. A request for https://example.com//page will send the header Location: //page/. The browser interprets this as a protocol-relative URL, so instead of redirecting to https://example.com//page/, it will attempt to redirect to . This is unlikely to resolve, but by crafting a URL in the form , it will send the header , which the browser translates as a redirect to . The subpath part is required because otherwise Astro will interpret as a file download, which skips trailing slash handling.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャンhttps://page/https://example.com//target.domain/subpathLocation: //target.domain/subpath/https://target.domain/subpath//target.domainThis leads to an Open Redirect vulnerability.
The URL needed to trigger the vulnerability varies according to the trailingSlash setting.
trailingSlash is set to "never", a URL in the form https://example.com//target.domain/subpath/trailingSlash is set to "always", a URL in the form https://example.com//target.domain/subpathhttps://example.com//target.domain/subpath//This is classified as an Open Redirection vulnerability (CWE-601). It affects any user who clicks on a specially crafted link pointing to the affected domain. Since the domain appears legitimate, victims may be tricked into trusting the redirected page, leading to possible credential theft, malware distribution, or other phishing-related attacks.
No authentication is required to exploit this vulnerability. Any unauthenticated user can trigger the redirect by clicking a malicious link.
Usrs can test if your site is affected by visiting https://yoursite.com//docs.astro.build/en//. If a user is redirected to the Astro docs then their site is affected and must be updated.
Upgrade to Astro 5.12.8. To mitigate at the network level, block outgoing redirect responses with a Location header value that starts with //.