Prototype Pollution Leading to Proxy Bypass in Axios

Executive Summary

This vulnerability involves axios in Node.js routing requests through an attacker-controlled proxy. axios hardens request configuration but interceptors can convert the hardened config back into a regular object. If Object.prototype.proxy is polluted, requests can be routed through the attacker's proxy, exposing sensitive data like Authorization headers and request bodies.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves prototype pollution in axios affecting Node.js deployments using the HTTP adapter. Detection requires checking for vulnerable axios versions (>=0.31.1 and <0.33.0, or >=1.15.2 and <1.18.0) and inspecting code for immutable interceptor patterns like {...config} or Object.assign({}, config).

Commands to check axios version: npm list axios or npm list -g axios. Review application code for interceptor usage and prototype pollution risks.

Useful 0 Not Useful 0

Impact Analysis

An attacker could intercept plaintext HTTP requests, view sensitive data such as Authorization headers, Basic auth, method, URL, Host, and request body. This could lead to unauthorized access to data or credentials if the attacker controls the proxy.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized exposure of personal or sensitive data, violating GDPR and HIPAA compliance requirements for data protection and confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade axios to a patched version: 0.33.0 or later for 0.x branch, or 1.18.0 or later for 1.x branch. Remove or replace immutable interceptor patterns with axios's built-in request/response interceptors.

If upgrading is not possible, disable the HTTP adapter's proxy support or implement strict input validation to prevent Object.prototype pollution.

Useful 0 Not Useful 0