CVE-2023-45857

Overview

Axios is a promise-based HTTP client for JavaScript applications running in the browser and Node.js. It provides a simple API, flexible request and response interceptors, and built-in support for automatic JSON transformation, request cancellation, and timeouts to simplify communication with APIs and services.

A vulnerability (CVE-2023-45857) has been identified in Axios’s handling of XSRF tokens in browser requests. Axios reads an XSRF token from a cookie and includes it in a request header to support CSRF protection. However, when withCredentials: true is configured, affected versions can attach this token to cross-origin requests. Using the default names, the XSRF-TOKEN cookie value is copied into the X-XSRF-TOKEN header, potentially exposing it to an attacker-controlled destination.

This exposure of an anti-CSRF token is classified under CWE-352 (Cross-Site Request Forgery) in the security advisory. CSRF occurs when an application cannot sufficiently verify that an authenticated request reflects the user’s intent. In Axios, disclosing the token to an untrusted host can undermine a token-based defense and potentially facilitate forged requests. Successful exploitation still depends on the application’s authentication requirements and other CSRF protections.

Details

Module Info

• Product: Axios
• Affected packages: axios
• Affected versions: <1.6.0; <0.28.0
• GitHub repository: https://github.com/axios/axios
• Published packages: https://www.npmjs.com/package/axios
• Package manager: npm
• Fixed in:
  • OSS Axios v1.15.1
  • OSS Axios v0.31.1
  • NES for Axios

Vulnerability Info

This medium-severity vulnerability affects browser applications using vulnerable Axios versions with withCredentials: true and an accessible XSRF token cookie. The affected request logic allows credentialed cross-origin requests to carry the token, even when the destination is outside the application’s origin. The GitHub advisory assigns a CVSS v3.1 score of 6.5.

If an attacker can cause the application to send a qualifying request to an attacker-controlled host, that host may receive the token in the request header. The immediate impact is disclosure of sensitive token information. Whether the token can subsequently enable unauthorized actions depends on the application’s remaining defenses.

This behavior aligns with CWE-352 (Cross-Site Request Forgery), as classified by the advisory. Token secrecy supports CSRF prevention; exposing a valid token can weaken that protection. However, possession of the token alone does not establish an authenticated session or guarantee a successful XSRF attack.

Mitigation

Users of affected Axios packages should apply one of the following mitigations:

• Upgrade to a patched version of the axios package.
• Leverage commercial support — HeroDevs provides security support for Axios.