Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| axios | npm | >= 0.28.0, < 0.34.0 | 0.34.0 |
| axios | npm | >= 1.15.1, < 1.20.0 | 1.20.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a prototype pollution gadget within the axios library. The primary vulnerable function is toFormData, which is responsible for serializing request data into FormData. This function reads several properties from an options object without proper hasOwnProperty checks. This allows an attacker who has polluted Object.prototype elsewhere in the application to control key aspects of the form data serialization process. This can lead to several impacts, including data exfiltration, denial of service, and data integrity issues.
The analysis of the provided patches confirms this. The changes in lib/helpers/toFormData.js directly address the issue by replacing direct property access with safer alternatives that check for property ownership. Specifically, one patch introduces a helper function that uses utils.getSafeProp, while another introduces toFormDataOptions to create a sanitized, null-prototype options object.
Furthermore, the patches reveal a broader effort to harden the library against prototype pollution. The modifications in lib/core/dispatchRequest.js and lib/core/Axios.js show that other parts of the request lifecycle were also vulnerable. In dispatchRequest, the configuration object is sanitized to prevent polluted properties from affecting request headers. In Axios.prototype.request, a check is added to ensure the default request method is not being inherited from a polluted prototype. Therefore, these functions are also included as part of the vulnerability.
toFormDatalib/helpers/toFormData.js
dispatchRequestlib/core/dispatchRequest.js
Axios.prototype.requestlib/core/Axios.js