Listen to this Post
The vulnerability exists in the `shouldBypassProxy()` function within Axios, which determines whether a request should bypass a configured proxy based on the `NO_PROXY` environment variable. The function relies on two helper methods, `isIPv4Loopback()` and isIPv6Loopback(), to identify loopback addresses. `isIPv4Loopback()` only checks for addresses in the `127.x.x.x` range by inspecting whether the first octet equals '127'. This causes the function to return `false` for 0.0.0.0, as its first octet is '0', even though on Linux systems `0.0.0.0` routes to the loopback interface. Similarly, `isIPv6Loopback()` only recognises `::1` as the IPv6 loopback address, failing to identify `::` (the unspecified IPv6 address) and `::ffff:0.0.0.0` (the IPv4-mapped IPv6 address for 0.0.0.0) as loopback. When `NO_PROXY=localhost` is configured, requests to these unrecognised addresses are incorrectly forwarded through the proxy instead of being sent directly. An attacker who controls a URL that an Axios client will request can supply http://0.0.0.0:8080/admin` as the target. The Axios client, configured with a proxy andNO_PROXY=localhost, will forward the request through the proxy. The proxy resolves `0.0.0.0` to its own loopback interface, reaching internal services that were intended to be protected. This enables Server-Side Request Forgery (SSRF) attacks against internal services reachable via the proxy's loopback interface. The attack requires no privileges and can be triggered remotely with low complexity, making it a high-severity issue. The vulnerable code path is present in Axios versions up to and including 1.16.1. A complete Docker-based end-to-end reproduction confirms that requests to0.0.0.0,::, and `::ffff:0.0.0.0` are sent via the proxy when `NO_PROXY=localhost` is set, while `127.0.0.1` correctly bypasses it. The official fix involves adding explicit checks for these addresses in the loopback detection functions.
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: Axios
Version: 1.16.1
Vulnerability: SSRF
Severity: High
date: 2025-02-27
<h2 style="color: blue;">Prediction: 2025-03-15</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
Logic verification: shouldBypassProxy() returns incorrect values
node -e "import shouldBypassProxy from 'axios/lib/helpers/shouldBypassProxy.js'; console.log(shouldBypassProxy('http://0.0.0.0:9999/'));" false (vulnerable)
node -e "import shouldBypassProxy from 'axios/lib/helpers/shouldBypassProxy.js'; console.log(shouldBypassProxy('http://[::]:9999/'));" false (vulnerable)
node -e "import shouldBypassProxy from 'axios/lib/helpers/shouldBypassProxy.js'; console.log(shouldBypassProxy('http://[::ffff:0.0.0.0]:9999/'));" false (vulnerable)
Docker E2E reproduction
cd /tmp/deep-e2e
docker compose up -d
docker compose exec attacker node test-ssrf.js
Actual Axios client test with proxy configuration
node -e "import axios from 'axios'; await axios.get('http://0.0.0.0:9999/', { proxy: { host: 'proxy', port: 8888 } }).catch(e => console.log(e.message));"
<h2 style="color: blue;">Exploit:</h2>
An attacker controls a URL that an Axios client requests, either directly or via an open redirect. The Axios client is configured with a proxy (e.g., a corporate proxy) and `NO_PROXY=localhost` to protect internal services. The attacker supplieshttp://0.0.0.0:8080/admin` as the target URL. Axios incorrectly forwards the request through the proxy instead of bypassing it. The proxy resolves `0.0.0.0` to its own loopback interface, reaching the internal admin service on port 8080. This allows the attacker to access internal services that should have been protected by the `NO_PROXY` setting.
Protection:
Apply the official code fix by adding explicit loopback checks in lib/helpers/shouldBypassProxy.js. As a workaround, add `0.0.0.0` and `::` to the `NO_PROXY` environment variable explicitly. Use `127.0.0.1` instead of `0.0.0.0` in all internal service URLs. Implement URL validation to reject `0.0.0.0` and `::` before passing to Axios. Upgrade to a patched version once available.
Impact:
An attacker can perform Server-Side Request Forgery (SSRF) attacks against internal services that are reachable via the proxy’s loopback interface. This can lead to information disclosure (access to internal service responses), integrity impact (triggering actions on internal services if the proxy supports PUT/POST/DELETE), and limited availability impact depending on internal service behavior. The attack requires no privileges and can be executed remotely with low complexity, making it a high-severity vulnerability. The likelihood is high in microservice architectures where proxy bypass is a common pattern and medium when attacker control over a URL is not always available.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
