Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Possible bug: Vulnerability SSRF

See original GitHub issue

Describe the bug

In my current project we are using Snyk to catch any possible issues and vulnerabilities. Snyk reports that since version 0.19.0 there is SSRF vulnerability that has no been fixed yet.

This is the message: Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF). An attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

Could you please verify? Thanks in advance.

To Reproduce

Any pen tests or just using Snyk to scan any app that uses axios.

Expected behavior

No vulnerabilities alerts.

Environment

Axios Version [0.21.0]
Adapter [HTTP]
Browser [All]
Browser Version [x]
Node.js Version [12.14.1]
OS: [x]
Additional Library Versions [x]

Additional context/Screenshots

Add any other context about the problem here. If applicable, add screenshots to help explain.

Issue Analytics

State:
Created 3 years ago
Reactions:1
Comments:11 (3 by maintainers)

Top GitHub Comments

17reactions

wickedestcommented, Dec 1, 2020

@jasonsaayman, do you have an ETA for v0.21.1 or a patch with respect to this CVE?

8reactions

jasonsaaymancommented, Dec 16, 2020

Hi All,

I am waiting for an ETA on this release, I will update as soon as I know when it will be or is out. If I could release this I would as I know its an issue for many people and even for me personally on my projects where CI/CD fails cause of it.

Thanks

Top Results From Across the Web

Server-side request forgery (SSRF) - PortSwigger

An SSRF exploit that causes connections to external third-party systems might result in malicious onward attacks that appear to originate from the organization ......

Top 25 Server-Side Request Forgery (SSRF)

In this article, we will discuss the Server-Side Request Forgery (SSRF) vulnerability, and present 25 disclosed reports based on this flaw.

Beginner Guide To Exploit Server Side Request Forgery ...

If a vulnerable SSRF web application is deployed in one of those Cloud Services, it will be very possible for an attacker to...

Server-Side Request Forgery (SSRF) - Bugcrowd

If not done correctly, then a server will be vulnerable to a Server-Side Request Forgery attack. SSRF is a dangerous attack vector and...

SSRF (Server Side Request Forgery) - HackTricks

Server-side request forgery (also known as SSRF) is a web security vulnerability that allows an attacker to induce the server-side application to make...