Description

Axios: Nested axios option objects can consume polluted prototype values ## Summary Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted Object.prototype. The top-level merged config is protected with a null prototype, but nested plain objects such as auth and paramsSerializer are cloned into ordinary objects. If application code passes placeholders such as auth: {} or paramsSerializer: {}, inherited username, password, encode, or serialize properties can influence outbound requests. ## Impact This is reachable only when another component has already polluted Object.prototype and the application passes an affected nested axios option object. Confirmed impacts include silent injection of an Authorization: Basic ... header from inherited username and password values, and query-string tampering when inherited paramsSerializer fields are function-valued. The auth case requires only string-valued pollution. Full query-string replacement through paramsSerializer.serialize requires a function-valued pollution primitive; string-only pollution may still cause request failures or encoding changes through encode. This does not mean every axios request is affected. Requests that do not pass auth, do not pass paramsSerializer, or provide explicit own properties for the relevant nested fields are not affected by this specific gadget. ## Affected Functionality Affected runtime functionality: - Node HTTP adapter Basic auth handling in lib/adapters/http.js. - Browser/fetch/XHR Basic auth handling through lib/helpers/resolveConfig.js. - Query serialization through lib/helpers/buildURL.js. - axios.getUri() when called with an affected paramsSerializer object. Affected config shapes: - auth: {} or an auth object missing own username and/or password. - paramsSerializer: {} or a paramsSerializer object missing own encode and/or serialize. Unaffected by this specific issue: - Requests with no auth property. - Requests with no paramsSerializer property. - Top-level polluted auth or paramsSerializer values in current hardened versions. ## Technical Details lib/core/mergeConfig.js creates the top-level merged config with Object.create(null), but nested object cloning still uses ordinary {} containers: js } else if (utils.isPlainObject(source)) { return utils.merge({}, source); } Downstream code then reads nested fields without own-property checks. In lib/helpers/resolveConfig.js: js btoa((auth.username || '') + ':' + (auth.password ? encodeUTF8(auth.password) : '')) In lib/adapters/http.js: js const username = configAuth.username || ''; const password = configAuth.password || ''; auth = username + ':' + password; In lib/helpers/buildURL.js: js const _encode = (options && options.encode) || encode; const serializeFn = _options && _options.serialize; ## Proof of Concept of Attack js import http from 'node:http'; import axios from './index.js'; const user = 'attacker'; const pass = 'exfil'; Object.defineProperty(Object.prototype, 'username', { value: user, configurable: true }); Object.defineProperty(Object.prototype, 'password', { value: pass, configurable: true }); Object.defineProperty(Object.prototype, 'serialize', { value: () => 'polluted=1', configurable: true }); const server = http.createServer((req, res) => { res.writeHead(200, { 'content-type': 'application/json' }); res.end(JSON.stringify({ authorization: req.headers.authorization || null, url: req.url })); }); await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve)); try { const port = server.address().port; const response = await axios.get(`http://127.0.0.1:${port}/demo`, { auth: {}, paramsSerializer: {}, params: { unused: 'ignored' } }); console.log(response.data); } finally { await new Promise((resolve) => server.close(resolve)); delete Object.prototype.username; delete Object.prototype.password; delete Object.prototype.serialize; } Observed result: json { "authorization": "Basic YXR0YWNrZXI6ZXhmaWw=", "url": "/demo?polluted=1" } ## Workarounds If upgrading is not yet possible, avoid passing placeholder nested option objects. Remove auth entirely when Basic auth is not intended. For paramsSerializer objects, provide explicit own encode and serialize properties or remove paramsSerializer when custom serialization is not required. These workarounds only address this axios gadget. They do not remediate the separate prototype-pollution primitive that must already exist in the application process.

Mitigation

Aliases

References