Junglewise Threat Intelligence

CVE-2020-28168: Axios Server-Side Request Forgery via redirect proxy bypass

CVE-2020-28168 · Severity: low · CVSS 3.1 · Published 2021-01-04

Technologies: Axios. Vendors: Axios.

Executive brief

Axios is a popular HTTP client library used in Node.js and browser applications to make web requests. A flaw allows an attacker to bypass proxy configurations by crafting requests that redirect to internal or restricted servers, potentially exposing internal network services or sensitive data. This could enable attackers to access systems that should be protected by proxy rules, leading to unauthorized access to internal infrastructure.

Technical details

Axios versions up to 0.21.0 fail to enforce proxy settings when following HTTP redirects. When an attacker provides a URL that returns a redirect response to a restricted destination (internal IP, localhost, or blocked host), Axios will follow that redirect without re-applying proxy configuration, bypassing the intended security control. This is a classic SSRF vulnerability (CWE-918). The vulnerability requires an attacker to control a URL that Axios will request (network-based attack with no authentication required), and the attacker must be able to respond with redirects to restricted addresses. The fix, applied in version 0.21.1, ensures that proxy settings are re-evaluated and applied to redirect destinations.

Affected products

  • axios axios 0 to 0.21.0

Timeline

  • 2021-01-04: disclosed: GHSA advisory published
  • 2020-11-24: patched: Fix committed to axios repository (version 0.21.1)
  • 2020-11-06: other: NVD entry published

References