Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| axios | npm | < 0.33.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a prototype pollution issue in axios. The advisory GHSA-f2r5-pqh9-r8f8 is a duplicate of GHSA-mmx7-hfxf-jppx, which provides more technical details. The core of the vulnerability is that several parts of the axios library read properties from configuration objects without properly checking if those properties are inherited from a polluted Object.prototype. This could lead to several security issues, including sending unintended request bodies, proxying requests through attacker-controlled servers, and custom URL serialization.
The issue is fixed in axios versions 1.18.0 and 0.33.0. I focused on the 1.x.x branch and identified the relevant changes by comparing v1.17.0 and v1.18.0. The key fix involves introducing a new utility function, utils.getSafeProp, which is designed to safely read properties from objects by ensuring they are either own properties or inherited from a non-Object.prototype source. This prevents values injected onto Object.prototype from being used.
Specifically, the following areas were patched:
axios.get(), axios.delete(), axios.head(), axios.options()): These methods construct a request configuration where the data property was read using (config || {}).data. If config was undefined or null, and Object.prototype.data was polluted, the polluted value would be used as the request body. The fix modifies lib/core/Axios.js to explicitly check for config.data using utils.hasOwnProp.lib/adapters/http.js): The httpAdapter function directly read various configuration properties (e.g., proxy, timeout, maxContentLength) without sufficient prototype pollution checks. The patch in lib/adapters/http.js replaces direct property access or utils.hasOwnProp checks with utils.getSafeProp to ensure safe reading of these properties.lib/helpers/buildURL.js): The paramsSerializer option, if polluted on Object.prototype, could be used to control URL serialization. The patch in lib/helpers/buildURL.js now uses utils.getSafeProp to access the serialize function from the options.lib/helpers/resolveConfig.js): The username and password properties within the auth configuration were vulnerable to pollution. The patch in lib/helpers/resolveConfig.js uses utils.getSafeProp to safely retrieve these credentials.These changes collectively address the prototype pollution vulnerabilities by ensuring that configuration properties are read in a safe manner, preventing attackers from injecting malicious values via Object.prototype.
Axios.prototype.requestlib/core/Axios.js
httpAdapterlib/adapters/http.js
buildURLlib/helpers/buildURL.js
resolveConfiglib/helpers/resolveConfig.js