PT-2020-6068 · Npm · Axios

Published 2020-11-06 · Updated 2022-09-13 · CVE-2020-28168

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Axios NPM package version 0.21.0

Description The issue is related to insufficient validation of incoming requests in the Axios library, which can be exploited by a remote attacker to perform a Server-Side Request Forgery (SSRF) attack. This allows the attacker to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

Recommendations For Axios NPM package version 0.21.0, consider disabling the vulnerable functionality until a patch is available. Restrict access to the axios library to minimize the risk of exploitation. Avoid using the url parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2021-02882

CVE-2020-28168

GHSA-4W2V-Q235-VP99

Affected Products

Axios

References · 24

• 🔥 https://github.com/axios/axios/issues/3369 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-28168 · Security Note
• https://ubuntu.com/security/CVE-2020-28168 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-28168 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02882 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-28168 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-28168 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-28168 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-28168 · Security Note
• https://osv.dev/vulnerability/GHSA-4w2v-q235-vp99 · Vendor Advisory
• https://github.com/axios/axios/commit/c7329fefc890050edd51e40e469a154d0117fc55 · Note
• https://lists.apache.org/thread.html/r954d80fd18e9dafef6e813963eb7e08c228151c2b6268ecd63b35d1f@%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/r954d80fd18e9dafef6e813963eb7e08c228151c2b6268ecd63b35d1f%40%3Ccommits.druid.apache.org%3E · Note
• https://snyk.io/vuln/SNYK-JS-AXIOS-1038255 · Note
• https://lists.apache.org/thread.html/r25d53acd06f29244b8a103781b0339c5e7efee9099a4d52f0c230e4a%40%3Ccommits.druid.apache.org%3E · Note