Published: 08/11/2023 Updated: 16/11/2023

CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8

VMScore: 0

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing malicious users to view sensitive information.

Vulnerable Product	Search on Vulmon	Subscribe to Product
axios axios 1.5.1

Debian Bug report logs - #1056099 node-axios: CVE-2023-45857 Package: src:node-axios; Maintainer for src:node-axios is Debian Javascript Maintainers <pkg-javascript-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 16 Nov 2023 21:09:01 UTC Severity: important Tags: pendi ...

DescriptionA flaw was found in Axios that exposes a confidential session token This flaw allows a remote attacker to bypass security measures and view sensitive dataA flaw was found in Axios that exposes a confidential session token This flaw allows a remote attacker to bypass security measures and view sensitive data ...

crowd-sourced migration guide for axios 1.0.0

axios-100-migration-guide crowd-sourced migration guide for axios100 CONTRIBUTING GUIDE axios links axios docs official migration guide axios Community Discussion Upgrade Guide needs to be updated with 0xx -> 100 Is axios@1 stable? CVE-2023-45857 axios@0x vulnerability and patch BREAKING CHANGES Documenting the potential breaking changes between 02721

TBO - Projekt Autorzy: Michał Adrjan Hubert Decyusz Daniel Stefański CICD Do stowrzenia CICD przy użyciu GitHub Actions zostały użyte narzędzia: SAST - Bandit DAST - ZAProxy SCA - Dependency Check Komponenty Workflow dla budowy obrazu z gałęzi main z tagiem: latest Workflow dla budowy obrazu z innej gałęzi z tagiem: beta Workflow do uruchomienia SAST Bandit

CVE-2023-45857の挙動を確認するデモ

axios の脆弱性 CVE-2023-45857 の動作を確認するデモ dev container で起動する app コンテナでnpm run devする applocalhostへアクセスするブラウザの開発者ツールで Cookie にXSRF-TOKENがセットされていることを確認する値がCREDENTIAL_TOKENとなっていること HttpOnly が false となっていること SameSit

CWE-352 https://github.com/axios/axios/issues/6006 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056099 https://nvd.nist.gov https://github.com/bmuenzenmeyer/axios-1.0.0-migration-guide https://access.redhat.com/security/cve/cve-2023-45857

CVE-2023-45857

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect