PT-2023-8832 · Axios+2 · Axios+2

Valentin-Panov · Published 2023-10-16 · Updated 2026-05-08 · CVE-2023-45857

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Axios versions 0.8.1 through 1.5.1

Description The issue is related to a JavaScript library and involves a cross-site request forgery vulnerability. This vulnerability can allow a remote attacker to gain unauthorized access to the XSRF-TOKEN. The confidential XSRF-TOKEN stored in cookies is inadvertently included in the HTTP header X-XSRF-TOKEN for every request made to any host, allowing attackers to view sensitive information.

Recommendations For Axios versions 0.8.1 through 1.5.1, consider disabling the inclusion of the XSRF-TOKEN in the HTTP header X-XSRF-TOKEN for every request as a temporary workaround until a patch is available. Restrict access to sensitive information stored in cookies to minimize the risk of exploitation. Avoid using the XSRF-TOKEN variable in the affected HTTP header until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2024-02118

CVE-2023-45857

GHSA-WF5P-G6VW-RHXX

RHSA-2024:1640

Affected Products

Axios

Debian

Red Os

References · 28

• 🔥 https://github.com/axios/axios/issues/6006 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-45857 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-45857 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02118 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2023-45857 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-45857 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-45857 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45857 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-45857 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wf5p-g6vw-rhxx · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-45857 · Vendor Advisory
• https://github.com/axios/axios · Note
• https://github.com/axios/axios/commit/2755df562b9c194fba6d8b609a383443f6a6e967 · Note
• https://github.com/axios/axios/releases/tag/v0.28.0 · Note