Executive brief
axios is a popular JavaScript HTTP client library used in web applications and Node.js servers to make requests to APIs and other services. A flaw in axios 1.3.2 through 1.7.3 allows attackers to craft malicious path-relative URLs that are incorrectly processed as protocol-relative URLs, causing the server to make unintended requests to arbitrary hosts instead of the intended base URL. This can lead to access of internal systems, data exfiltration, or other attacks from within the server environment.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) caused by improper URL parsing introduced in axios 1.3.2. When the Node.js URL parser was given a base URL of 'http://localhost' for resolving relative paths, protocol-relative URLs (starting with //) are treated as absolute by the URL standard and bypass the baseURL entirely. An attacker can inject a URL like '//google.com' into a path parameter that the application constructs via baseURL + path, and the Node.js URL class will resolve it with the protocol from 'http://localhost', causing the request to go to an arbitrary host. This affects applications using axios on the server-side that concatenate user-controlled input with a baseURL. The vulnerability was patched in version 1.7.4 to properly validate and reject protocol-relative URLs in this context.
Affected products
- axios axios 1.3.2 through 1.7.3
Timeline
- 2024-06-24: disclosed
- 2024-08-12: advisory
- 2024-08-12: patched: Fixed in axios 1.7.4