SSRF and Credential Leakage in Axios baseURL Handling
Axios contains a flaw in request URL handling where supplying an absolute URL to request methods overrides the configured baseURL instead of remaining constrained to the intended origin. As described in the provided content, when applications rely on baseURL for request scoping but pass attacker-controlled or otherwise untrusted absolute URLs, Axios will send the request to that absolute destination. This can result in server-side request forgery in server-side deployments and can also leak credentials or sensitive headers to unintended third-party hosts. The issue affects both server-side and client-side usage of Axios and is fixed in Axios 1.8.2.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains two HTML/JavaScript proof-of-concept files demonstrating CVE-2025-27152, a credential leak vulnerability in Axios v1.6.8 when used in a browser context. Both files create an Axios client with a preset baseURL, and in the case of 'axios-credsteal.html', also set an Authorization header and enable withCredentials. The user is prompted to enter an absolute URL, which is then used as the target for an Axios GET request. This allows an attacker to supply a malicious endpoint (such as a webhook or controlled server) and receive sensitive credentials (headers and cookies) from the victim's browser. The exploit demonstrates how improper handling of absolute URLs in Axios can lead to credential leakage across origins. The repository is structured as two standalone HTML files, each serving as an independent PoC for the vulnerability.
This repository is a full-stack demonstration application (Angular frontend, NestJS backend) designed to showcase two specific vulnerabilities: SSRF (Server-Side Request Forgery) and Path Traversal, specifically in the context of the axios library (version 1.8.1, vulnerable to CVE-2025-27152). The backend exposes API endpoints for movie data, using axios to interact with the external TMDB API. The SSRF vulnerability is present in the backend's search functionality, where user-supplied input is used in requests to external URLs via axios. The Path Traversal vulnerability is present in the downloads middleware, which allows crafted URLs to access files outside the intended directory (e.g., '/api/downloads/linda/..%2f..%2f..%2fdist%2fmain.ts'). The README provides explicit instructions for exploiting both vulnerabilities. The repository is structured into 'backend' (NestJS API) and 'frontend' (Angular app) directories, with supporting configuration and test files. The main entry points for exploitation are the backend API endpoints, which can be accessed directly or via the frontend. The code is intended for educational and demonstration purposes, not as a weaponized exploit.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A denial-of-service vulnerability in the brace-expansion library where a zero step value in a brace pattern can trigger an infinite loop and excessive memory allocation, causing the process to hang.
A vulnerability in the Axios HTTP client library that can lead to server-side request forgery (SSRF) risks; the content states Storm-2755 appears to exploit it as part of its AiTM relay flow.
A vulnerability in the Axios HTTP client that can lead to server-side request forgery (SSRF); the content suggests Storm-2755 may have leveraged it as part of its AiTM attack path.
An Axios-related vulnerability involving SSRF and credential leakage, mentioned as part of vendor security history.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.