REDHAT-BUG-2456913: SSRF
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0, Axios does not correctly handle hostname normalization when checking NOPROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NOPROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NOPROXY is set up to protect loopback or internal services. This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. This vulnerability is fixed in 1.15.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
axiosto a version that resolves this vulnerability.Fixed in 1.15.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2456913?
The severity of REDHAT-BUG-2456913 is classified as high with a score of 7.
What are the potential risks associated with REDHAT-BUG-2456913?
The risks associated with REDHAT-BUG-2456913 include potential Server-Side Request Forgery (SSRF) attacks due to improper hostname normalization.
How do I fix REDHAT-BUG-2456913?
To fix REDHAT-BUG-2456913, update Axios to version 1.15.0 or later where the issue has been resolved.
In which software is REDHAT-BUG-2456913 found?
REDHAT-BUG-2456913 is found in the npm package Axios.
What kind of vulnerability is REDHAT-BUG-2456913 categorized as?
REDHAT-BUG-2456913 is categorized as a Server-Side Request Forgery (SSRF) vulnerability.