CyberRota Analysis
AI-GeneratedCertain versions of axios are vulnerable due to a failure to recognize 0.0.0.0 as a loopback address, allowing requests to this address to bypass NO_PROXY rules. This vulnerability can enable attackers to route requests through configured proxies, potentially exposing sensitive local services. Organizations using affected axios versions should prioritize remediation to mitigate the risk of unauthorized access to internal resources.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.