Описание
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.
A flaw was found in axios, a popular JavaScript library. An attacker can exploit this vulnerability by providing malicious form data containing deeply nested field names. This input triggers uncontrolled recursion within the formDataToJSON function, which is responsible for processing form data. The excessive recursion exhausts the application's JavaScript call stack, leading to a denial of service for the affected request or, in some cases, causing the entire application process to terminate.
Отчет
This Important flaw in the axios JavaScript library allows an unauthenticated remote attacker to cause a denial of service. By submitting crafted form data with excessively nested bracket-delimited field names, an attacker can trigger uncontrolled recursion in the formDataToJSON function (exposed as axios.formToJSON() and used internally by the default transformRequest when FormData is sent with Content-Type: application/json), exhausting the JavaScript call stack and causing a RangeError that may terminate the application process. This vulnerability affects applications that pass attacker-controlled FormData field names to axios' FormData-to-JSON conversion.
Меры по смягчению последствий
Upgrade to axios >= 1.18.0 (1.x) or >= 0.33.0 (0.x), which add recursion depth guards to formDataToJSON. If an immediate upgrade is not possible, validate and limit the nesting depth of FormData field names before passing them to axios.formToJSON() or before sending FormData through axios with Content-Type: application/json, and ensure error handling is in place to catch RangeError exceptions from this code path.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | axios | Not affected | ||
| Cryostat 4 | cryostat-openshift-console-plugin-npm | Not affected | ||
| Gatekeeper 3 | gatekeeper/gatekeeper-rhel9 | Not affected | ||
| Migration Toolkit for Applications 8 | mta/mta-ui-rhel9 | Not affected | ||
| Migration Toolkit for Containers | rhmtc/openshift-migration-ui-rhel8 | Not affected | ||
| Multicluster Engine for Kubernetes | multicluster-engine/console-mce-rhel9 | Not affected | ||
| Network Observability Operator | network-observability/network-observability-console-plugin-pf4-rhel9 | Not affected | ||
| Network Observability Operator | network-observability/network-observability-console-plugin-pf5-rhel9 | Not affected | ||
| Network Observability Operator | network-observability/network-observability-console-plugin-rhel9 | Not affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-hub-ui-rhel8 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 ...
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
Уязвимость функции formDataToJSON библиотеки axios, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
7.5 High
CVSS3