CyberRota Analysis
AI-GeneratedThe Astro web framework versions 8.1.0 through 11.0.1 are vulnerable when configured with trailingSlash: 'always', allowing an attacker to exploit the static file handler's mismanagement of paths starting with a backslash. This misconfiguration can lead to unintended 301 redirects to external hosts, potentially exposing users to phishing or other malicious sites. Organizations using affected versions with this specific configuration should prioritize updating to version 11.0.2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Astro is a web framework for content-driven websites. In versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ (slash-backslash) were not recognized as internal paths, so the handler would echo the raw path back in the Location header. Because browsers treat \ as / per the WHATWG URL specification, the resulting redirect could resolve to an external host. Preconditions for exploitation: trailingSlash: 'always' must be set (non-default; the default is 'ignore'), the request path must not have a file extension in its final segment, and an attacker must deliver the crafted link to a user. This issue has been fixed in version 11.0.2.