awslabs / awslabs/aws-crt-nodejs
Axios dependency contains known security vulnerabilities (GHSA-43fc-jf86-j433, GHSA-3p68-rc4w-qgx5, GHSA-fvcv-3m26-pcqx)
- Dominant language
- TypeScript
- Stars
- 43
- Forks
- 32
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 1
Description
### Describe the bug
The current axios dependency (`^1.12.2`, resolved to `1.12.2`) contains three known security vulnerabilities:
| Advisory | Severity | Description |
|---|---|---|
| [GHSA-43fc-jf86-j433](https://github.com/advisories/GHSA-43fc-jf86-j433) | High (CVSS 7.5) | Denial of Service via `__proto__` key in `mergeConfig` — affects `>=1.0.0 <=1.13.4` |
| [GHSA-3p68-rc4w-qgx5](https://github.com/advisories/GHSA-3p68-rc4w-qgx5) | Moderate (CVSS 4.8) | `NO_PROXY` hostname normalization bypass leading to SSRF — affects `>=1.0.0 <1.15.0` |
| [GHSA-fvcv-3m26-pcqx](https://github.com/advisories/GHSA-fvcv-3m26-pcqx) | Moderate (CVSS 4.8) | Unrestricted cloud metadata exfiltration via header injection chain — affects `>=1.0.0 <1.15.0` |
Since `aws-crt-nodejs` is a transitive dependency of `aws-sdk` and `aws-sdk-v3`, these vulnerabilities are inherited by all downstream consumers. This is also related to #607.
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Expected Behavior
The `axios` dependency should be pinned to a version that has no known security vulnerabilities (`>=1.15.1`).
### Current Behavior
Running `npm audit` on a project that depends on `aws-crt-nodejs` reports:
```
axios >=1.0.0
Severity: high/moderate
- Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
- Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
- Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
```
### Reproduction Steps
```bash
git clone https://github.com/awslabs/aws-crt-nodejs.git
cd aws-crt-nodejs
npm install --ignore-scripts
npm audit
```
### Possible Solution
Update the `axios` version in both `dependencies` and `overrides` in `package.json` from `^1.12.2` to `^1.15.1`, which is the first version that resolves all three vulnerabilities.
### Additional Information/Context
- `npm audit` confirms no axios vulnerabilities after updating to `1.15.1`.
- A fix for this is ready as a pull request.
- Long-term, issue #607 proposes replacing axios entirely with built-in Node.js alternatives.
### aws-crt-nodejs version used
1.21.0 (latest release)
### nodejs version used
v20.9.0
### Operating System and version
Ubuntu 20.04.5 LTS
Contributor guide
Research direction
Update the axios version in both dependencies and overrides in package.json, changing ^1.12.2 to ^1.15.1. Start by running npm install --ignore-scripts and npm audit as shown in the reproduction steps; done means npm audit no longer reports the three listed axios vulnerabilities.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, typescript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 75/100