CVE-2025-27152 (Medium) Detected In Axios-0.21.4.tgz

Mar 9, 2025 by ADMIN 53 views

CVE-2025-27152 (Medium) Detected in axios-0.21.4.tgz: A Critical Vulnerability in a Popular HTTP Client Library

Introduction

In the ever-evolving landscape of open-source software, vulnerabilities can creep in at any moment, putting the security of applications and users at risk. One such vulnerability has been detected in the popular HTTP client library, axios-0.21.4.tgz, with a severity rating of Medium. In this article, we will delve into the details of the CVE-2025-27152 vulnerability, its impact, and the suggested fix to ensure the security of your applications.

CVE-2025-27152 - Medium Severity Vulnerability

The axios-0.21.4.tgz library is a promise-based HTTP client for both the browser and node.js. However, a critical vulnerability has been discovered in this library, which can lead to Server-Side Request Forgery (SSRF) and credential leakage. This issue arises when passing absolute URLs instead of protocol-relative URLs to axios, even if the baseURL is set.

Vulnerable Library Details

Vulnerable Library: axios-0.21.4.tgz
Library Home Page: https://registry.npmjs.org/axios/-/axios-0.21.4.tgz
Path to Dependency File: /azure-static-web-app/api/node/package.json
Path to Vulnerable Library: /azure-static-web-app/api/node/node_modules/axios/package.json,/azure-function/node/node_modules/axios/package.json

Dependency Hierarchy

The vulnerability is part of a larger dependency hierarchy, which includes:

mssql-6.3.1.tgz (Root Library)
- tedious-6.7.0.tgz
  - ms-rest-nodeauth-2.0.2.tgz
    - ms-rest-js-1.11.2.tgz
      - :x: axios-0.21.4.tgz (Vulnerable Library)

Found in HEAD Commit and Base Branch

The vulnerability was found in the HEAD commit with the ID 43865d4f6b2ee0eeedf98bd8edb8aff4c6e1a637 and is also present in the main branch.

Vulnerability Details

The axios library is designed to be a promise-based HTTP client for both the browser and node.js. However, the issue arises when passing absolute URLs instead of protocol-relative URLs to axios, even if the baseURL is set. This can lead to SSRF and credential leakage, impacting both server-side and client-side usage of axios.

Publish Date and URL

Publish Date: 2025-03-07
URL: https://www.mend.io/vulnerability-database/CVE-2025-27152

CVSS 3 Score Details (5.5)

The CVSS 3 score for this vulnerability is 5.5, indicating a Medium severity rating. The score is broken down into the following metrics:

Base Score Metrics:
- Exploitability Metrics:
  - Attack Vector: Local
  - Attack Complexity: Low
  - Privileges Required: None
  - User Interaction: Required
  - Scope: Unchanged
- Impact Metrics:
  - Confidentiality Impact: None
  - Integrity Impact: None
  - Availability Impact: High

Suggested Fix

The suggested fix for this vulnerability is to upgrade the version of axios to 1.8.2. This fix was released on 2025-03-07 and can be found in the GitHub advisory with the ID GHSA-jr5f-v2jv-69x6.

Conclusion

The detection of CVE-2025-27152 in the axios-0.21.4.tgz library highlights the importance of regular security audits and vulnerability assessments in open-source software. By staying informed about the latest vulnerabilities and following the suggested fixes, developers can ensure the security of their applications and protect their users from potential threats.

Step Up Your Open Source Security Game with Mend

To stay ahead of the curve and ensure the security of your applications, consider using Mend's full solution for GitHub. With Mend, you can:

Identify vulnerabilities: Mend's advanced security analytics and machine learning algorithms can identify vulnerabilities in your code, even before they are exploited.
Prioritize fixes: Mend's prioritization engine helps you focus on the most critical vulnerabilities, ensuring that you address the most pressing security risks first.
Automate fixes: Mend's automated fix engine can help you resolve vulnerabilities quickly and efficiently, reducing the time and effort required to fix security issues.

Learn more about Mend's full solution for GitHub and take the first step towards securing your applications today.
CVE-2025-27152 (Medium) Detected in axios-0.21.4.tgz: A Critical Vulnerability in a Popular HTTP Client Library - Q&A

Introduction

In our previous article, we discussed the detection of CVE-2025-27152 in the axios-0.21.4.tgz library, a popular HTTP client library for both the browser and node.js. This vulnerability has a severity rating of Medium and can lead to Server-Side Request Forgery (SSRF) and credential leakage. In this Q&A article, we will address some of the most frequently asked questions about this vulnerability and provide additional information to help developers understand the impact and fix the issue.

Q: What is CVE-2025-27152, and how does it affect my application?

A: CVE-2025-27152 is a Medium severity vulnerability in the axios-0.21.4.tgz library, which can lead to Server-Side Request Forgery (SSRF) and credential leakage. This issue arises when passing absolute URLs instead of protocol-relative URLs to axios, even if the baseURL is set. If your application uses axios and passes absolute URLs, it may be vulnerable to this issue.

Q: What is Server-Side Request Forgery (SSRF), and how does it affect my application?

A: Server-Side Request Forgery (SSRF) is a type of attack where an attacker can trick your application into making requests to unintended destinations, potentially leading to sensitive data exposure or other security issues. In the case of CVE-2025-27152, an attacker can exploit this vulnerability to make requests to unintended destinations, potentially leading to credential leakage or other security issues.

Q: How can I identify if my application is vulnerable to CVE-2025-27152?

A: To identify if your application is vulnerable to CVE-2025-27152, you can follow these steps:

Check your application's dependencies to see if it uses axios-0.21.4.tgz.
Review your application's code to see if it passes absolute URLs to axios.
If you find that your application is vulnerable, update axios to the latest version (1.8.2 or later).

Q: What is the impact of CVE-2025-27152 on my application?

A: The impact of CVE-2025-27152 on your application depends on how it is used. If your application uses axios and passes absolute URLs, it may be vulnerable to this issue. This can lead to Server-Side Request Forgery (SSRF) and credential leakage, potentially exposing sensitive data or leading to other security issues.

Q: How can I fix CVE-2025-27152 in my application?

A: To fix CVE-2025-27152 in your application, you can follow these steps:

Update axios to the latest version (1.8.2 or later).
Review your application's code to ensure that it does not pass absolute URLs to axios.
Consider using a more secure HTTP client library, such as axios 1.8.2 or later.

Q: What is the CVSS 3 score for CVE-2025-27152, and what does it mean?

A: The CVSS 3 score for CVE-2025-27152 is 5.5, indicating a Medium severity rating. This score is based on the following metrics:

Base Score Metrics:
- Exploitability Metrics:
  - Attack Vector: Local
  - Attack Complexity: Low
  - Privileges Required: None
  - User Interaction: Required
  - Scope: Unchanged
- Impact Metrics:
  - Confidentiality Impact: None
  - Integrity Impact: None
  - Availability Impact: High

Q: How can I stay informed about the latest vulnerabilities and security issues in my application?

A: To stay informed about the latest vulnerabilities and security issues in your application, you can:

Monitor security advisories: Regularly check security advisories and vulnerability databases, such as the National Vulnerability Database (NVD) or the Common Vulnerabilities and Exposures (CVE) database.
Use a security scanner: Use a security scanner, such as a web application scanner or a code analysis tool, to identify potential security issues in your application.
Implement a vulnerability management program: Implement a vulnerability management program to regularly scan and test your application for security issues.

Conclusion

CVE-2025-27152 is a critical vulnerability in the axios-0.21.4.tgz library, which can lead to Server-Side Request Forgery (SSRF) and credential leakage. By understanding the impact and fix of this vulnerability, developers can ensure the security of their applications and protect their users from potential threats.