Prototype Pollution in Axios Leading to Authorization Header Injection

Executive Summary

This vulnerability affects the axios library before version 0.33.0 and 1.x before 1.18.0. It allows inherited properties from nested request option objects to be consumed when the JavaScript process's Object.prototype has been polluted by another component. The top-level merged config uses a null prototype, but nested plain objects like auth and paramsSerializer are cloned into ordinary objects and read without checking for own properties. This can lead to silent injection of an Authorization header or altered query-string serialization if prototype pollution exists.

Useful 0 Not Useful 0

Detection Guidance

Detection involves checking for prototype pollution in your JavaScript environment and verifying axios versions. Inspect Object.prototype for unexpected properties and ensure axios is updated to 0.33.0 or 1.18.0 or later.

Useful 0 Not Useful 0

Impact Analysis

If you use an affected version of axios and your application environment has prototype pollution, attackers could inject malicious properties into nested request options. This might result in unauthorized requests being made with injected Authorization headers or modified query parameters, potentially leading to data breaches or unauthorized access to sensitive resources.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exposure, violating confidentiality requirements in GDPR and HIPAA. If exploited, it may result in unauthorized transactions or data leaks, potentially causing non-compliance with data protection regulations and leading to legal or financial penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update axios to version 0.33.0 or 1.18.0 or later. Review and sanitize any user-controlled input that may pollute Object.prototype. Avoid passing placeholder nested objects like auth: {} or paramsSerializer: {}.

Useful 0 Not Useful 0