CVE-2025-52552
📋 TL;DR
FastGPT versions before 4.9.12 have an open redirect and DOM-based XSS vulnerability in the LastRoute parameter on the login page. Attackers can execute malicious JavaScript in users' browsers or redirect them to malicious sites. This affects all FastGPT instances running vulnerable versions.
💻 Affected Systems
- FastGPT
📦 What is this software?
Fastgpt by Fastgpt
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal user session tokens, credentials, or perform actions as authenticated users, potentially leading to account takeover and data theft.
Likely Case
Attackers redirect users to phishing sites or execute limited JavaScript in victims' browsers to steal session data.
If Mitigated
With proper input validation and sanitization, the attack is prevented entirely.
🎯 Exploit Status
Exploitation requires tricking users into clicking malicious links but doesn't require authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.9.12
Vendor Advisory: https://github.com/labring/FastGPT/security/advisories/GHSA-r976-rfrv-q24m
Restart Required: Yes
Instructions:
1. Update FastGPT to version 4.9.12 or later. 2. Restart the FastGPT service. 3. Verify the update was successful.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to reject malicious LastRoute parameter values
Implement regex validation: ^[a-zA-Z0-9\/\-\._]+$ for LastRoute parameter
WAF Rule
allConfigure WAF to block requests with suspicious LastRoute parameters
Add WAF rule to block URLs containing javascript: or http:// in LastRoute parameter
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to prevent script execution
- Monitor and block suspicious redirect patterns in application logs
🔍 How to Verify
Check if Vulnerable:
Check if FastGPT version is below 4.9.12 in application settings or deployment configuration.Check Version:
Check FastGPT web interface settings or deployment configuration files for version number.Verify Fix Applied:
Confirm version is 4.9.12 or higher and test that malicious LastRoute parameters are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual redirect patterns in access logs
- Requests with suspicious LastRoute parameter values
Network Indicators:
- Unexpected redirects to external domains from login page
SIEM Query:
source="fastgpt_logs" AND (url="*LastRoute=javascript:*" OR url="*LastRoute=http://*")