-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| axios | npm | >= 1.0.0, < 1.8.2 | 1.8.2 |
| axios | npm | < 0.30.0 | 0.30.0 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability originated in the buildFullPath function, which incorrectly handled cases where a baseURL was configured but an absolute URL was provided as requestedURL. Instead of ensuring the final URL adhered to the baseURL's domain or path, it would return the absolute requestedURL directly. This flaw was exploited by functions that used buildFullPath to construct the final request URL, namely httpAdapter (for Node.js HTTP requests) and xhrAdapter (for browser XMLHttpRequest). These adapters, when invoked via the primary Axios.prototype.request method (or its aliases like get, post, etc.), would then make requests to the attacker-specified absolute URL, ignoring the baseURL. This could lead to Server-Side Request Forgery (SSRF) if the attacker provided an internal URL, or credential leakage if the baseURL configuration included sensitive headers (like API keys) that were then sent to the attacker's server. The patches addressed this by modifying buildFullPath to introduce an allowAbsoluteUrls option and ensure baseURL is respected unless explicitly overridden, and by updating the adapter functions to correctly use this modified buildFullPath.
Ongoing coverage of React2Shell