Update dependency axios to v0.30.3 [SECURITY] by renovate[bot] · Pull Request #262 · apay-io/transfer-server

renovate · 2023-05-28T10:09:09Z

This PR contains the following updates:

Package	Change	Age	Confidence
axios (source)	`0.21.1` → `0.30.3`

axios Inefficient Regular Expression Complexity vulnerability

CVE-2021-3749 / GHSA-cph5-m8f7-6c5x

More information

Details

axios before v0.21.2 is vulnerable to Inefficient Regular Expression Complexity.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios Cross-Site Request Forgery Vulnerability

CVE-2023-45857 / GHSA-wf5p-g6vw-rhxx

More information

Details

An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios is Vulnerable to Denial of Service via proto Key in mergeConfig

CVE-2026-25639 / GHSA-43fc-jf86-j433

More information

Details

Denial of Service via proto Key in mergeConfig

Summary

The mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.

Details

The vulnerability exists in lib/core/mergeConfig.js at lines 98-101:

utils.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) {
  const merge = mergeMap[prop] || mergeDeepProperties;
  const configValue = merge(config1[prop], config2[prop], prop);
  (utils.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
});

When prop is '__proto__':

JSON.parse('{"__proto__": {...}}') creates an object with __proto__ as an own enumerable property
Object.keys() includes '__proto__' in the iteration
mergeMap['__proto__'] performs prototype chain lookup, returning Object.prototype (truthy object)
The expression mergeMap[prop] || mergeDeepProperties evaluates to Object.prototype
Object.prototype(...) throws TypeError: merge is not a function

The mergeConfig function is called by:

Axios._request() at lib/core/Axios.js:75
Axios.getUri() at lib/core/Axios.js:201
All HTTP method shortcuts (get, post, etc.) at lib/core/Axios.js:211,224

PoC

import axios from "axios";

const maliciousConfig = JSON.parse('{"__proto__": {"x": 1}}');
await axios.get("https://httpbin.org/get", maliciousConfig);

Reproduction steps:

Clone axios repository or npm install axios
Create file poc.mjs with the code above
Run: node poc.mjs
Observe the TypeError crash

Verified output (axios 1.13.4):

TypeError: merge is not a function
    at computeConfigValue (lib/core/mergeConfig.js:100:25)
    at Object.forEach (lib/utils.js:280:10)
    at mergeConfig (lib/core/mergeConfig.js:98:9)

Control tests performed:

Test	Config	Result
Normal config	`{"timeout": 5000}`	SUCCESS
Malicious config	`JSON.parse('{"__proto__": {"x": 1}}')`	CRASH
Nested object	`{"headers": {"X-Test": "value"}}`	SUCCESS

Attack scenario:
An application that accepts user input, parses it with JSON.parse(), and passes it to axios configuration will crash when receiving the payload {"__proto__": {"x": 1}}.

Impact

Denial of Service - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

Node.js servers using axios for HTTP requests
Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

axios/axios (axios)

Uh oh!

Conversation

renovate Bot commented May 28, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

axios Inefficient Regular Expression Complexity vulnerability

Details

Severity

References

Axios Cross-Site Request Forgery Vulnerability

Details

Severity

References

Axios is Vulnerable to Denial of Service via proto Key in mergeConfig

Details

Denial of Service via proto Key in mergeConfig

Summary

Details

PoC

Impact

Severity

References

Release Notes

v0.30.3: Release notes - v0.30.3

🛡️ Security Fixes

⚙️ Maintenance & CI

⚠️ Breaking Changes

What's Changed

New Contributors

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Release notes:

Bug Fixes

Release notes:

Bug Fixes

Backports from v1.x:

Fixes and Functionality:

Breaking changes:

QOL and DevX improvements:

Fixes and Functionality:

Internal and Tests:

Documentation:

Notes:

Fixes and Functionality:

Fixes and Functionality:

Breaking changes:

Fixes and Functionality:

Internal and Tests:

Documentation:

Breaking changes:

Breaking changes:

Fixes and Functionality:

Internal and Tests:

Documentation:

Fixes and Functionality:

Fixes and Functionality:

Fixes and Functionality:

Fixes and Functionality:

Internal and Tests:

Documentation:

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented May 28, 2023 •

edited

Loading

`v0.30.3`: Release notes - v0.30.3