Axios Fetch Adapter Prototype Pollution in Headers

Executive Summary

This vulnerability affects the Axios library versions 1.7.0 to 1.20.0. It involves a prototype pollution flaw in the fetch adapter where attacker-controlled headers can override sanitized request headers. The issue arises because fetchOptions inherits properties from Object.prototype, allowing malicious headers like Authorization to be injected or legitimate ones removed.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect your Axios usage for the fetch adapter in versions 1.7.0 to 1.20.0. Check for prototype pollution in your application by reviewing code that modifies Object.prototype. Monitor HTTP requests for unexpected header modifications or authorization bypasses.

Useful 0 Not Useful 0

Impact Analysis

An attacker could manipulate HTTP requests by altering headers, potentially bypassing security controls such as authorization checks. This could lead to unauthorized access, data leaks, or application-specific behavior changes. Exploitation requires prior prototype pollution in the same process.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized header manipulation in HTTP requests. Attackers could inject malicious headers like Authorization to bypass security controls, access sensitive data, or alter application behavior, which may violate data protection requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Axios to version 1.20.0 or later. If using the fetch adapter, switch to the Node HTTP adapter as a temporary workaround. Avoid passing empty fetchOptions objects in environments prone to prototype pollution.

Useful 0 Not Useful 0