CVE-2023-45857: CSRF
An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
Other sources
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
— MITRE
Axios is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By inserting the X-XSRF-TOKEN header using the secret XSRF-TOKEN cookie value in all requests to any server when the XSRF-TOKEN0 cookie is available, and the withCredentials setting is turned on, an attacker could exploit this vulnerability to perform cross-site scripting attacks, Web cache poisoning, and other malicious activities.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2023-45857.
What is the severity of CVE-2023-45857?
The severity of CVE-2023-45857 has not been specified.
How does Axios 0.8.1 through 1.5.1 reveal the XSRF-TOKEN?
Axios 0.8.1 through 1.5.1 inadvertently includes the XSRF-TOKEN stored in cookies in the HTTP header X-XSRF-TOKEN for every request.
What software versions are affected by CVE-2023-45857?
Axios versions 0.8.1 through 1.5.1 are affected by CVE-2023-45857.
How can I fix CVE-2023-45857?
To fix CVE-2023-45857, update to Axios 1.6.0 or later.