Disable redirect following

Oct 13, 2025 by leolavanderia.com.br 94 views

[HIGH] axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

Introduction

axios is a popular JavaScript library used for making HTTP requests in web applications. It provides a simple and intuitive API for sending HTTP requests and interacting with web servers. However, a recent security alert has highlighted a potential vulnerability in axios requests that could lead to Server-Side Request Forgery (SSRF) and credential leakage via absolute URLs.

What is SSRF?

Server-Side Request Forgery (SSRF) is a type of web application vulnerability that allows an attacker to trick the server into making requests to unintended destinations. This can be achieved by manipulating the URL of a request in a way that the server will interpret it as a valid request. SSRF can be used to access internal systems, databases, or other sensitive resources that are not intended to be accessed from the outside.

What is Credential Leakage?

Credential leakage refers to the unauthorized disclosure of sensitive information, such as passwords, API keys, or other credentials. This can occur when an attacker is able to intercept or obtain sensitive information through a vulnerability in the application.

The Vulnerability

The vulnerability in axios requests is related to the use of absolute URLs in requests. An absolute URL is a URL that includes the protocol (e.g., HTTP or HTTPS) and the domain name. When an absolute URL is used in an axios request, the library will automatically follow the redirect chain, which can lead to SSRF and credential leakage.

Example Use Case

Here is an example of how the vulnerability can be exploited:

import axios from 'axios';

const url = 'https://example.com/api/endpoint';
const headers = {
  'Authorization': 'Bearer <API_KEY>'
};

axios.get(url, { headers })
  .then(response => {
    console.log(response.data);
  })
  .catch(error => {
    console.error(error);
  });

In this example, the url variable is an absolute URL that includes the protocol and domain name. The headers object includes an Authorization header with a sensitive API key. When the axios request is made, the library will automatically follow the redirect chain, which can lead to SSRF and credential leakage.

How to Exploit the Vulnerability

To exploit the vulnerability, an attacker can manipulate the URL of the request to point to an unintended destination. For example:

const url = 'http://internal-system.example.com/api/endpoint';
const headers = {
  'Authorization': 'Bearer <API_KEY>'
};

axios.get(url, { headers })
  .then(response => {
    console.log(response.data);
  })
  .catch(error => {
    console.error(error);
  });

In this example, the url variable is manipulated to point to an internal system that is not intended to be accessed from the outside. The headers object still includes the sensitive API key.

How to Prevent the Vulnerability

To prevent the vulnerability, developers can use the following best practices:

Use relative URLs: Instead of using absolute URLs, use relative URLs that do not include the protocol or domain name.
Disable redirect following: Set the followRedirects option to false when making axios requests to prevent the library from following the redirect chain.
Validate user input: Validate user input to prevent malicious URLs from being used in requests.
Use a secure protocol: Use a secure protocol (e.g., HTTPS) to encrypt sensitive information and prevent eavesdropping.

Conclusion

The vulnerability in axios requests highlights the importance of secure coding practices and the need to validate user input. By following best practices and using secure coding techniques, developers can prevent SSRF and credential leakage via absolute URLs.

Recommendations

Based on the analysis of the vulnerability, the following recommendations are made:

Update axios to the latest version: Update axios to the latest version to ensure that the vulnerability is patched.
Use relative URLs: Use relative URLs instead of absolute URLs to prevent the vulnerability.
Disable redirect following: Set the followRedirects option to false when making axios requests to prevent the library from following the redirect chain.
Validate user input: Validate user input to prevent malicious URLs from being used in requests.

References

Additional Information

The vulnerability was reported by a GitHub user and is tracked in the following issue:

GitHub issue

Disclosure

This article is for informational purposes only and is not intended to be a comprehensive guide to secure coding practices. The author of this article is not responsible for any damages or losses resulting from the use of this information.
[HIGH] axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL: Q&A

Introduction

In our previous article, we discussed the vulnerability in axios requests that could lead to Server-Side Request Forgery (SSRF) and credential leakage via absolute URLs. In this article, we will answer some frequently asked questions (FAQs) related to this vulnerability.

Q: What is Server-Side Request Forgery (SSRF)?

A: Server-Side Request Forgery (SSRF) is a type of web application vulnerability that allows an attacker to trick the server into making requests to unintended destinations. This can be achieved by manipulating the URL of a request in a way that the server will interpret it as a valid request.

Q: What is credential leakage?

A: Credential leakage refers to the unauthorized disclosure of sensitive information, such as passwords, API keys, or other credentials. This can occur when an attacker is able to intercept or obtain sensitive information through a vulnerability in the application.

Q: How can I prevent SSRF and credential leakage via absolute URLs?

A: To prevent SSRF and credential leakage via absolute URLs, you can use the following best practices:

Use relative URLs: Instead of using absolute URLs, use relative URLs that do not include the protocol or domain name.
Disable redirect following: Set the followRedirects option to false when making axios requests to prevent the library from following the redirect chain.
Validate user input: Validate user input to prevent malicious URLs from being used in requests.
Use a secure protocol: Use a secure protocol (e.g., HTTPS) to encrypt sensitive information and prevent eavesdropping.

Q: What is the impact of this vulnerability?

A: The impact of this vulnerability is that an attacker can potentially access internal systems, databases, or other sensitive resources that are not intended to be accessed from the outside. Additionally, an attacker can obtain sensitive information, such as passwords or API keys, through credential leakage.

Q: How can I update axios to the latest version?

A: To update axios to the latest version, you can use the following command:

npm install axios@latest

Or, if you are using yarn:

yarn add axios@latest

Q: What are some common mistakes that can lead to this vulnerability?

A: Some common mistakes that can lead to this vulnerability include:

Using absolute URLs: Using absolute URLs can lead to SSRF and credential leakage.
Not validating user input: Not validating user input can allow malicious URLs to be used in requests.
Not disabling redirect following: Not disabling redirect following can allow the library to follow the redirect chain and lead to SSRF and credential leakage.

Q: How can I test for this vulnerability?

A: To test for this vulnerability, you can use the following steps:

Use a tool like Burp Suite: Use a tool like Burp Suite to intercept and analyze HTTP requests.
Manipulate the URL: Manipulate the URL of a request to point to an unintended destination.
Check for SSRF and credential leakage: Check for SSRF and credential leakage by analyzing the response from the server.

Q: What are some best practices for secure coding?

A: Some best practices for secure coding include:

Validate user input: Validate user input to prevent malicious URLs from being used in requests.
Use relative URLs: Use relative URLs instead of absolute URLs.
Disable redirect following: Set the followRedirects option to false when making axios requests.
Use a secure protocol: Use a secure protocol (e.g., HTTPS) to encrypt sensitive information and prevent eavesdropping.

Conclusion

In this article, we answered some frequently asked questions related to the vulnerability in axios requests that could lead to Server-Side Request Forgery (SSRF) and credential leakage via absolute URLs. By following best practices and using secure coding techniques, developers can prevent SSRF and credential leakage and ensure the security of their applications.

References

Additional Information

The vulnerability was reported by a GitHub user and is tracked in the following issue:

GitHub issue