CVE-2025-52552: Fastgpt Fastgpt XSS Vulnerability

CVE-2025-52552 Overview

CVE-2025-52552 affects FastGPT, an AI agent building platform developed by labring. Versions prior to 4.9.12 fail to validate and sanitize the LastRoute parameter on the login page. Attackers can craft URLs that trigger DOM-based Cross-Site Scripting (XSS) [CWE-79] or redirect authenticated users to attacker-controlled destinations. The FastGPT maintainers released version 4.9.12 to address the flaw.

Critical Impact
Successful exploitation enables arbitrary JavaScript execution in the victim's browser session and open redirect attacks that facilitate credential phishing against FastGPT users.

Affected Products

FastGPT versions prior to 4.9.12
Deployments exposing the login page with LastRoute handling
Self-hosted labring/FastGPT instances

Discovery Timeline

2025-06-21 - CVE-2025-52552 published to the National Vulnerability Database
2025-06-21 - GitHub Security Advisory GHSA-r976-rfrv-q24m issued by labring
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52552

Vulnerability Analysis

The vulnerability resides in FastGPT's login flow, which reads the LastRoute query parameter from the URL to determine where the user should be sent after authentication. The client-side code processes this parameter without validating the destination or sanitizing embedded script content. Attackers who convince a user to visit a crafted FastGPT login URL can therefore control post-login navigation and inject JavaScript into the login page context.

Because the injection is DOM-based, the malicious payload never traverses the server and executes entirely within the browser. This bypasses server-side logging and many traditional web application firewall rules that inspect HTTP request bodies. Combined with the open redirect behavior, an attacker can chain phishing, session theft, and forced navigation to malicious FastGPT clones.

Root Cause

The root cause is improper input validation and missing output encoding on the LastRoute parameter. The login handler treats the parameter as a trusted URL fragment and passes it into client-side navigation or DOM sinks without allowlisting internal paths or encoding script-relevant characters.

Attack Vector

An attacker distributes a URL such as https://victim-fastgpt.example.com/login?lastRoute=<payload> through email, chat, or social media. When a FastGPT user clicks the link and authenticates, the crafted payload either executes JavaScript in their session or redirects them to an attacker domain. User interaction is required, but no prior authentication or privileges are needed to launch the attack.

typescript

// Patch excerpt: env.d.ts — V4.9.12 (#5022)
       DEFAULT_ROOT_PSW: string;
       DB_MAX_LINK: string;
       FILE_TOKEN_KEY: string;
+      AES256_SECRET_KEY: string;
       ROOT_KEY: string;
       OPENAI_BASE_URL: string;
       CHAT_API_KEY: string;

Source: FastGPT commit 095b75e

The 4.9.12 release introduces an AES256_SECRET_KEY and a typed HeaderSecretTypeEnum that formalize how sensitive parameters and secrets are handled across the platform:

typescript

// Patch excerpt: packages/global/common/secret/constants.ts
+import { i18nT } from '../../../web/i18n/utils';
+
+export enum HeaderSecretTypeEnum {
+  None = 'None',
+  Bearer = 'Bearer',
+  Basic = 'Basic',
+  Custom = 'Custom'
+}

Source: FastGPT commit 095b75e

Detection Methods for CVE-2025-52552

Indicators of Compromise

Login URLs containing suspicious LastRoute or lastRoute values with javascript:, data:, or external hostnames
Web server access logs showing /login requests with URL-encoded HTML entities or script tokens in query parameters
Outbound browser navigation from FastGPT domains to unrecognized destinations immediately after /login
User reports of unexpected redirects or credential prompts after clicking FastGPT links

Detection Strategies

Inspect proxy and web server logs for requests to FastGPT /login that carry LastRoute parameters referencing absolute URLs or non-allowlisted paths
Deploy client-side content security policy (CSP) reporting to capture inline script violations originating from the login page
Correlate authentication events with subsequent redirects to identify chained phishing attempts

Monitoring Recommendations

Alert on any FastGPT deployment reporting a version string below 4.9.12 from asset inventory scans
Track anomalous referrer patterns pointing to the FastGPT login endpoint from external social platforms
Monitor DNS resolutions from user endpoints for lookalike FastGPT domains used in redirect campaigns

How to Mitigate CVE-2025-52552

Immediate Actions Required

Upgrade all FastGPT instances to version 4.9.12 or later without delay
Rotate API keys, tokens, and administrative credentials exposed to users who may have followed crafted LastRoute links
Notify FastGPT users of the phishing risk and instruct them to access the platform only through bookmarked URLs

Patch Information

The fix is included in FastGPT 4.9.12, released via commit 095b75ee27746004106eddeaa4840688a61ff6eb. Details are documented in the GitHub Security Advisory GHSA-r976-rfrv-q24m.

Workarounds

Place FastGPT behind a reverse proxy that strips or validates the LastRoute query parameter against an internal allowlist
Enforce a strict Content Security Policy that disallows inline scripts and external script sources on the login page
Restrict access to the FastGPT login endpoint using VPN or SSO gateways until patching is complete

bash

# Example nginx rule to drop external LastRoute values before they reach FastGPT
location = /login {
    if ($arg_lastRoute ~* "^(https?:|javascript:|data:|//)") {
        return 400;
    }
    proxy_pass http://fastgpt_upstream;
}