Listen to this Post
The vulnerability occurs in server-side applications using the `axios-cache-interceptor` library to proxy requests to an upstream service. The flaw is in how the library generates its cache key. It uses only the request URL, completely ignoring headers specified in the upstream server’s `Vary` response header, such as Authorization. When an upstream service correctly signals that its response varies by the `Authorization` header (by sending Vary: Authorization), the caching library fails to honor this. Consequently, the first authenticated user’s response is stored in cache using only the URL as the key. All subsequent requests from different users to the same URL, but with different authorization tokens, receive the cached response belonging to the first user. This results in a complete authorization bypass, where User B receives the private, cached data of User A, effectively poisoning the cache across authentication boundaries.
Platform: Node.js
Version: axios-cache-interceptor <1.11.1
Vulnerability: Authorization Bypass
Severity: Critical
date:
Prediction: 2023-10-04
What Undercode Say:
npm list axios-cache-interceptor
const { setupCache } = require('axios-cache-interceptor');
const cachedAxios = setupCache(axios.create());
const response = await cachedAxios.get(upstreamURL, { headers: { Authorization: userToken } });
// Check if response was served from a poisoned cache
console.log('Cached:', response.cached);
How Exploit:
1. Attacker sends request to vulnerable proxy server.
- Proxy forwards request to upstream, receives `Vary: Authorization` header.
3. Proxy incorrectly caches response using only URL.
- Victim sends request with different auth token to same endpoint.
5. Proxy serves attacker’s cached data to victim.
Protection from this CVE
Upgrade to `axios-cache-interceptor` version 1.11.1 or later. The fix enables automatic respect for the `Vary` header, incorporating specified header values (like Authorization) into the cache key hash. No additional configuration is required post-upgrade.
Impact:
Authorization bypass leading to horizontal privilege escalation and leakage of sensitive user data across authenticated sessions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
