Executive brief
Axios is a widely-used JavaScript HTTP client library for making web requests. A vulnerability in versions 0.8.1 through 1.5.1 causes the library to inadvertently leak the XSRF-TOKEN (a security token meant to prevent cross-site attacks) to any external host by including it in request headers. An attacker can exploit this by tricking users into visiting a malicious site to harvest these tokens and perform unauthorized actions on behalf of the victim.
Technical details
This vulnerability is a token leakage issue (CWE-352, CWE-359) in Axios HTTP client. The root cause is that Axios automatically includes the XSRF-TOKEN from cookies in the X-XSRF-TOKEN HTTP header for all outbound requests, regardless of the destination host. An attacker can craft a malicious webpage that causes a user's browser to make requests via Axios to the attacker's server, thereby leaking the XSRF-TOKEN. No authentication is required; user interaction (visiting a link) is the only precondition. An attacker obtaining the token can then forge legitimate-looking requests to the victim's application. Fixes are available in Axios 0.28.0 and 1.6.0 or later.
Affected products
- axios axios 0.8.1 through 1.5.1
Timeline
- 2023-11-08: disclosed
- 2023-11-08: patched: Axios versions 0.28.0 and 1.6.0+ released with fix