Prototype pollution in axios - #VU127595

Detailed vulnerability description

The vulnerability allows a remote attacker to bypass application-level authentication checks and suppress HTTP error handling.

The vulnerability exists due to improperly controlled modification of object prototype attributes ('prototype pollution') in lib/core/mergeConfig.js and lib/core/settle.js when merging request configuration after Object.prototype has been polluted with a crafted validateStatus property. A remote attacker can pollute Object.prototype.validateStatus with a function that always returns true to bypass application-level authentication checks and suppress HTTP error handling.

Exploitation requires chaining with an existing prototype pollution condition elsewhere in the application stack.

Remediation

Sources

• https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63
• https://github.com/advisories/GHSA-w9j2-pvgh-6h63