Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SSRF vulnerability in Axios #1217

Closed
huydoan2 opened this issue Nov 9, 2020 · 6 comments
Closed

SSRF vulnerability in Axios #1217

huydoan2 opened this issue Nov 9, 2020 · 6 comments
Labels
status: help wanted requesting help from the community type: security known security issue

Comments

@huydoan2
Copy link

huydoan2 commented Nov 9, 2020

Issue Summary

The latest version of sendgrid-nodejs, 7.4.0 is using axios 0.19.2 which contains a Server Side Request Forgery (SSRF) vulnerability. Currently there's no patch available from axios. Please update sendgrid-nodejs whenever the fixes are available.

Axios tracking issue:
axios/axios#3369

Vulnerability report from Snyk:
https://snyk.io/vuln/SNYK-JS-AXIOS-1038255

Technical details:

  • sendgrid-nodejs version: 7.4.0
  • node version: v14.12.0

Note

@sendgrid/mail will also need to be updated when fixes are available.
@thinkingserious thinkingserious added status: help wanted requesting help from the community type: security known security issue labels Nov 12, 2020
@thinkingserious
Copy link
Contributor

Thank you for reporting this @huydoan2!

@shackbarth
Copy link

This vulnerability has since been fixed on axios@0.21.1. Can you bump this dependency when you get a chance?

matt-catellier added a commit to matt-catellier/sendgrid-nodejs that referenced this issue Jan 5, 2021
@matt-catellier
Update package.json
c91d0c3 
Update axios to 0.21.1 to resolve SSRF outlined here sendgrid#1217
@matt-catellier matt-catellier mentioned this issue Jan 5, 2021
Closed
8 tasks
@matt-catellier
Copy link

Thanks @shackbarth. I create a pull request with changes to review here @thinkingserious #1236

@thinkjrs thinkjrs mentioned this issue Jan 5, 2021
Closed
@matt-catellier
Copy link

Any update on this? Will be resolved by this merge request #1239

@jgravois
Copy link

jgravois commented Jan 7, 2021

fix has been published to npm as v7.4.1

@ananay
Copy link

ananay commented Mar 18, 2021

Hey! I think we can close this issue :)
Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
status: help wanted requesting help from the community type: security known security issue
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@thinkingserious @shackbarth @jgravois @ananay @shwetha-manvinkurke @matt-catellier @huydoan2