Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CSRF vulnerability in AXIOS 0.24.1 to latest #6022

Closed
mmatra opened this issue Oct 23, 2023 · 12 comments
Closed

CSRF vulnerability in AXIOS 0.24.1 to latest #6022

mmatra opened this issue Oct 23, 2023 · 12 comments

Comments

@mmatra
Copy link

mmatra commented Oct 23, 2023

Describe the bug

AXIOS contains a CSRF Vulnerability

Axios contains a cross-site request forgery (CSRF) vulnerability due to insecure HTTP endpoint permission validation. An attacker could exploit this vulnerability by sending a crafted link to a victim to execute malicious actions on their behalf.

Below are the versions which contain this vulnerability

axios | 0.21.4
axios | 0.26.1
axios | 1.0.0
axios | 1.3.6
axios | 1.4.0
axios | 1.5.1 : Latest

To Reproduce

NA

Code snippet

No response

Expected behavior

AXIOS should not have this vulnerability

Axios Version

0.24.1, 0.26.3, 1.5.1

Adapter Version

No response

Browser

No response

Browser Version

No response

Node.js Version

No response

OS

No response

Additional Library Versions

No response

Additional context/Screenshots

No response
@theta682
Copy link

Probably related to #6006

@valentin-panov valentin-panov mentioned this issue Oct 24, 2023
Closed
@anuraggo
Copy link

This issue is reported in BlackDuck scan. Here is detailed report -

image

@milotoor milotoor mentioned this issue Oct 25, 2023
Closed
1 task
@PacoPeralta
Copy link

Snyk is also detecting this error:
https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459
Unfortunately at this point as per report, there is not an axios version with a fix.

@ahmedsamy64
Copy link

Hello guys, is there any fix for this?

@albertodiazdorado
Copy link

Also interested. Isn't the fix super easy to implement?

53817f8

@anuraggo
Copy link

anuraggo commented Oct 26, 2023 •
edited

Also interested. Isn't the fix super easy to implement?

53817f8

@valentin-panov I see this commit in PR and is in progress #6028
I guess we need to wait until its merged ?

@sarahkonimeti
Copy link

what is the potential ETA for this PR to be resolved please?

This was referenced Oct 26, 2023
Closed
Closed
@jerell-mendoza
Copy link

Hi, I just wanted to bump this as well as my team is interested in seeing this resolved as well! Thank you team!

@CrossEyedRobot
Copy link

This is an issue for my application also. Is there a planned fix?

@emzeidan
Copy link

Update: It looks like the related PR #6028 was just merged. I'm guessing a new release shouldn't be too far off.

@emzeidan
Copy link

v1.6.0 has just been released with this patched.

@andrewjwu andrewjwu mentioned this issue Oct 30, 2023
Closed
@agilgur5 agilgur5 mentioned this issue Oct 31, 2023
Closed
@samjarman
Copy link

I'm confused why this doesn't show up in yarn audit/npm audit? Can anyone enlighten me please? Thank you!

@github-actions github-actions bot mentioned this issue Nov 2, 2023
Open
@AldoFusterTurpin AldoFusterTurpin mentioned this issue Nov 10, 2023
Closed
@rvitaliy rvitaliy mentioned this issue Nov 14, 2023
Open
@simo-an simo-an mentioned this issue Dec 1, 2023
Closed
@wolfm89 wolfm89 mentioned this issue Dec 27, 2023
Closed
@debricked debricked bot mentioned this issue Jan 26, 2024
Merged
@FrancoAguzzi FrancoAguzzi mentioned this issue Feb 6, 2024
Closed
@Nikhil-Ashoka Nikhil-Ashoka mentioned this issue Mar 21, 2024
Merged
bradbishop pushed a commit to openbmc/webui-vue that referenced this issue Mar 25, 2024
@Nikhil-Ashoka
Upgraded Axios version
b88444c 
- Current Axios version was 0.21.4, this version has CSRF vulnerability. Referring to this issue:
  axios/axios#6022, Axios contains a cross-site request forgery (CSRF) vulnerability due to insecure HTTP endpoint permission validation. An attacker could exploit this vulnerability by sending a crafted link to a victim to execute malicious actions on their behalf.
- v1.6.0 has fixed this problem, Upgraded the version to the same.
- Reference: axios/axios#6028

Signed-off-by: Nikhil Ashoka <a.nikhil@ibm.com>
Change-Id: I43719d2dd4524ad1de647f7753a6c923762e1e80
bradbishop pushed a commit to openbmc/webui-vue that referenced this issue Mar 25, 2024
@Nikhil-Ashoka
Upgraded Axios version
768d96e 
- Current Axios version was 0.21.4, this version has CSRF vulnerability. Referring to this issue:
  axios/axios#6022, Axios contains a cross-site request forgery (CSRF) vulnerability due to insecure HTTP endpoint permission validation. An attacker could exploit this vulnerability by sending a crafted link to a victim to execute malicious actions on their behalf.
- v1.6.0 has fixed this problem, Upgraded the version to the same.
- Reference: axios/axios#6028

Signed-off-by: Nikhil Ashoka <a.nikhil@ibm.com>
Change-Id: I43719d2dd4524ad1de647f7753a6c923762e1e80
bradbishop pushed a commit to openbmc/webui-vue that referenced this issue Mar 25, 2024
@Nikhil-Ashoka
Upgraded Axios version
63833da 
- Current Axios version was 0.21.4, this version has CSRF vulnerability. Referring to this issue:
  axios/axios#6022, Axios contains a cross-site request forgery (CSRF) vulnerability due to insecure HTTP endpoint permission validation. An attacker could exploit this vulnerability by sending a crafted link to a victim to execute malicious actions on their behalf.
- v1.6.0 has fixed this problem, Upgraded the version to the same.
- Reference: axios/axios#6028

Signed-off-by: Nikhil Ashoka <a.nikhil@ibm.com>
Change-Id: I43719d2dd4524ad1de647f7753a6c923762e1e80
bradbishop pushed a commit to openbmc/webui-vue that referenced this issue Mar 25, 2024
@Nikhil-Ashoka
Upgraded Axios version
8409ac6 
- Current Axios version was 0.21.4, this version has CSRF vulnerability. Referring to this issue:
  axios/axios#6022, Axios contains a cross-site request forgery (CSRF) vulnerability due to insecure HTTP endpoint permission validation. An attacker could exploit this vulnerability by sending a crafted link to a victim to execute malicious actions on their behalf.
- v1.6.0 has fixed this problem, Upgraded the version to the same.
- Reference: axios/axios#6028

Signed-off-by: Nikhil Ashoka <a.nikhil@ibm.com>
Change-Id: I43719d2dd4524ad1de647f7753a6c923762e1e80
bradbishop pushed a commit to openbmc/webui-vue that referenced this issue Mar 26, 2024
@Nikhil-Ashoka
Upgraded Axios version
8a92296 
- Current Axios version was 0.21.4, this version has CSRF vulnerability. Referring to this issue:
  axios/axios#6022, Axios contains a cross-site request forgery (CSRF) vulnerability due to insecure HTTP endpoint permission validation. An attacker could exploit this vulnerability by sending a crafted link to a victim to execute malicious actions on their behalf.
- v1.6.0 has fixed this problem, Upgraded the version to the same.
- Reference: axios/axios#6028

Signed-off-by: Nikhil Ashoka <a.nikhil@ibm.com>
Change-Id: I43719d2dd4524ad1de647f7753a6c923762e1e80
bradbishop pushed a commit to openbmc/webui-vue that referenced this issue Mar 27, 2024
@Nikhil-Ashoka
Upgraded Axios version
11c24f8 
- Current Axios version was 0.21.4, this version has CSRF vulnerability. Referring to this issue:
  axios/axios#6022, Axios contains a cross-site request forgery (CSRF) vulnerability due to insecure HTTP endpoint permission validation. An attacker could exploit this vulnerability by sending a crafted link to a victim to execute malicious actions on their behalf.
- v1.6.0 has fixed this problem, Upgraded the version to the same.
- Reference: axios/axios#6028

Signed-off-by: Nikhil Ashoka <a.nikhil@ibm.com>
Change-Id: Ifb0d64c7d4d15d2396ee6d83d609ab8522d9e247
@martin-badin martin-badin mentioned this issue Mar 27, 2024
Open
bradbishop pushed a commit to openbmc/webui-vue that referenced this issue Apr 2, 2024
@Nikhil-Ashoka @gtmills
Upgraded Axios version
54d12c6 
Current Axios version was 0.21.4, this version has a CSRF vulnerability.
axios/axios#6022.

v1.6.0 has fixed this problem, upgrade Axios to that version.
Reference: axios/axios#6028

The package-lock.json was generated by pointing bitbake at my local repo
and building the image. devtool modify -n  webui-vue <local repo>

This uses the npm version in yocto 10.4.0.

Signed-off-by: Nikhil Ashoka <a.nikhil@ibm.com>
Change-Id: Ifb0d64c7d4d15d2396ee6d83d609ab8522d9e247
Signed-off-by: Gunnar Mills <gmills@us.ibm.com>
bradbishop pushed a commit to openbmc/webui-vue that referenced this issue Apr 2, 2024
@Nikhil-Ashoka @gtmills
Upgraded Axios version
129aecd 
Current Axios version was 0.21.4, this version has a CSRF vulnerability.
axios/axios#6022.

v1.6.0 has fixed this problem, upgrade Axios to that version.
Reference: axios/axios#6028

The package-lock.json was generated by pointing bitbake at my local repo
and building the image. devtool modify -n  webui-vue <local repo>

This uses the npm version in yocto 10.4.0.

Tested: Loaded this on a p10bmc and GUI looked good.

Signed-off-by: Nikhil Ashoka <a.nikhil@ibm.com>
Change-Id: Ifb0d64c7d4d15d2396ee6d83d609ab8522d9e247
Signed-off-by: Gunnar Mills <gmills@us.ibm.com>
@MehmetYararVX MehmetYararVX mentioned this issue Apr 13, 2024
Open
@iSpyte iSpyte mentioned this issue May 4, 2024
Closed
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests