Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Server-Side Request Forgery in axios #9

Open
maiznadeem opened this issue Aug 27, 2024 · 1 comment
Open

Server-Side Request Forgery in axios #9

maiznadeem opened this issue Aug 27, 2024 · 1 comment

Comments

@maiznadeem
Copy link

image

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

Package: axios (npm)
Affected versions: >= 1.3.2, <= 1.7.3
Patched version: 1.7.4

Please update the axios package in this repository.
@caineblood
Copy link

that is malware to steal your account; do not under any circumstances download or run it. The post needs to be removed. If you have attempted to run it please have your system cleaned and your account secured immediately.

@maiznadeem maiznadeem mentioned this issue Aug 27, 2024
Closed
schalkwijk added a commit to schalkwijk/groupdocs-conversion-cloud-node that referenced this issue Aug 28, 2024
@schalkwijk
Bump version of axios to fix CVE-2024-28849 and others.
c3d7de9 
This CVE is associated with `follow-redirects`, which is brought in by `axios`, so bumping `axios` to version 1.7.5 brings in the updated version of `follow-redirects` (1.15.6) without the vulnerability. This also resolves [another CVE here](groupdocs-conversion-cloud#9).
schalkwijk added a commit to schalkwijk/groupdocs-conversion-cloud-node that referenced this issue Aug 28, 2024
@schalkwijk
Bump version of axios to fix CVE-2024-28849 and others.
0b22f36 
This CVE is associated with `follow-redirects`, which is brought in by `axios`, so bumping `axios` to version 1.7.5 brings in the updated version of `follow-redirects` (1.15.6) without the vulnerability. This also resolves [another CVE here](groupdocs-conversion-cloud#9).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Bump version of axios to fix CVE-2024-28849 schalkwijk/groupdocs-conversion-cloud-node
3 participants
@maiznadeem @caineblood and others