Prototype Pollution Vulnerability in Axios: Inherited Properties in Nested Option Objects

Background

Axios is a popular promise-based HTTP client for JavaScript, designed to make HTTP requests easier and more intuitive. It supports features like request and response interception, automatic JSON data transformation, and the ability to cancel requests. However, a vulnerability exists in Axios that allows it to consume inherited properties from nested request option objects when the JavaScript process has a polluted Object.prototype, leading to potential security risks.

Vulnerability Detail

The vulnerability arises from Axios's handling of nested option objects, such as 'auth' and 'paramsSerializer'. When these objects are passed as placeholders (e.g., auth: {}), Axios can inadvertently read inherited properties from Object.prototype, which may have been polluted by other components in the application. This can result in silent injection of sensitive data, such as 'Authorization' headers containing attacker-controlled credentials, or tampering with query strings. The vulnerability is particularly concerning because it can lead to unauthorized access and data exfiltration without any visible errors or warnings.

npm install axios@1.20.0

Workaround

If immediate upgrading is not feasible, avoid passing placeholder nested option objects. Specifically, remove the 'auth' property entirely when Basic auth is not intended. For 'paramsSerializer', provide explicit own 'encode' and 'serialize' properties or remove 'paramsSerializer' when custom serialization is not required. Here is an example of how to avoid passing placeholders:

const response = await axios.get('http://example.com/api', {
  paramsSerializer: {
    encode: (value) => encodeURIComponent(value),
    serialize: (params) => new URLSearchParams(params).toString(),
  },
  // Do not pass empty auth object
});

Conclusion

In summary, the prototype pollution vulnerability in Axios poses significant risks by allowing inherited properties from polluted Object.prototype to be used in HTTP requests. It is crucial to update to the latest version of Axios to mitigate these risks and ensure the security of your application.

See every vulnerability recorded for axios →

FAQ