7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-39338

CVE-2024-39338: Server-Side Request Forgery in axios

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-39338

CVE-2024-39338:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
axios	npm	>= 1.3.2, <= 1.7.3	1.7.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The SSRF vulnerability in axios (CVE-2024-39338) stemmed primarily from how URLs were parsed and resolved in server-side environments, specifically within the httpAdapter function. This function, in vulnerable versions, used new URL(fullPath, 'http://localhost'). This behavior, introduced in version 1.3.2, meant that if fullPath could be controlled to be a protocol-relative URL (e.g., //attacker.com), it would resolve to http://attacker.com, bypassing the intended baseURL and leading to SSRF.

The isAbsoluteURL helper function also played a crucial role. Its pre-fix behavior incorrectly identified protocol-relative URLs as non-absolute. This caused the buildFullPath function (which uses isAbsoluteURL) to combine the baseURL with the protocol-relative URL, forming a string like https://legit.com//attacker.com. Even this combined string, when passed to the vulnerable httpAdapter's new URL(..., 'http://localhost') call, would still resolve to https://attacker.com due to how the URL constructor handles paths starting with // after a host.

The patch commit 6b6b605eaf73852fb2dae033f1e786155959de3a addressed both issues:

It modified httpAdapter to pass undefined as the base to new URL() in server-side environments, causing protocol-relative URLs to correctly throw an 'Invalid URL' error.
It corrected isAbsoluteURL to properly recognize protocol-relative URLs as absolute, ensuring buildFullPath handles them correctly by not prepending a baseURL if the input URL is already protocol-relative.

Both functions were involved in the vulnerable logic: httpAdapter contained the direct SSRF mechanism via the new URL call with a fixed 'http://localhost' base, and the pre-patch isAbsoluteURL facilitated the construction of a fullPath that could trigger this mechanism.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.