GHSA-44g4-m2mj-wpvx Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

• npm axios: >= 1.15.0, < 1.20.0 → fixed in 1.20.0

Summary Axios supports proxy environment variables and evaluates `NO_PROXY` exclusions in the Node.js adapter. CIDR-form `NO_PROXY` entries such as `127.0.0.0/8`, `10.0.0.0/8`, or `169.254.169.254/32` are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusion can still be sent through the configured proxy. This affects deployments that rely on CIDR notation to keep loopback, private, Kubernetes, CI, or cloud metadata traffic away from proxy infrastructure. Impact If the configured proxy is outside the intended trust boundary, requests that operators expected to bypass the proxy may be exposed to it. For plaintext HTTP targets, the proxy can see and modify URLs, headers, and bodies. For HTTPS targets, the proxy still observes connection metadata and may receive CONNECT requests that policy expected to avoid. This is a proxy exclusion bypass, not arbitrary proxy injection by itself. Affected Functionality Affected: • Node.js adapter proxy environment handling. • `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`, or lowercase equivalents. • CIDR entries in `NO_PROXY`. Not affected: • Exact host or exact IP `NO_PROXY` entries where axios matching succeeds. • Requests configured with `proxy: false`. • Browser adapters. Technical Details `lib/helpers/shouldBypassProxy.js` parses each `NO_PROXY` entry into a host and optional port, normalizes hostnames, and then compares exact hostnames, suffix entries, wildcard-prefix entries, and loopback equivalents. It does not parse CIDR notation. Local verification on axios `1.18.1`: ```js process.env.NO_PROXY = '127.0.0.0/8'; shouldBypassProxy('http://127.0.0.1:1234/'); // false ``` The expected result for CIDR-aware bypass policy is `true`. Proof of Concept of Attack Constrained local demonstration: 1. Set `HTTP_PROXY=http://127.0.0.1:`. 2. Set `NO_PROXY=127.0.0.0/8`. 3. Request `http://127.0.0.1:/metadata`. 4. Observe that axios sends the request through the proxy instead of directly to the internal listener. Workarounds Use exact host or IP entries in `NO_PROXY` for sensitive destinations until CIDR matching is fixed, for example `127.0.0.1,localhost,169.254.169.254`. For individual requests that must not use a proxy, set `proxy: false`. Original report Summary Axios 1.17.0 honors `HTTP_PROXY` / `HTTPS_PROXY` and supports `NO_PROXY` host exclusions, but CIDR-form `NO_PROXY` entries such as `127.0.0.0/8` are not treated as network ranges. As a result, requests to IPs covered by a configured CIDR exclusion may still be sent through the configured proxy. In the attached PoC, a request to `127.0.0.1` is sent through `HTTP_PROXY` despite `NO_PROXY=127.0.0.0/8`. This can cause proxy exclusion bypass in environments where operators use CIDR notation to exclude loopback, private, internal, Kubernetes, CI, or cloud metadata address ranges from proxying. Details Axios supports proxy environment variables, including `HTTP_PROXY` / `HTTPS_PROXY` and `NO_PROXY`-style exclusions. Axios’s threat model treats environment proxy handling as security-relevant and lists `NO_PROXY` as a mitigation for proxy environment variable hijack, including hardening for CIDR ranges, IPv6 literals, and wildcard patterns. See: https://github.com/axios/axios/blob/a8e4f13aeecc45a3b8fab3ecfd9ddb5d70fb772b/THREATMODEL.md#t-r9-proxy-environment-variable-hijack The issue is that CIDR-form `NO_PROXY` entries are not interpreted as network ranges. For example: ```text NO_PROXY=127.0.0.0/8 HTTP_PROXY=http://127.0.0.1: Target URL=http://127.0.0.1:/metadata ``` Since `127.0.0.1` is inside `127.0.0.0/8`, an operator may reasonably expect Axios to bypass the proxy for this request. Instead, Axios sends the request through `HTTP_PROXY`. This appears to affect the proxy bypass decision path used for `NO_PROXY` / `no_proxy` handling. The relevant behavior is in Axios's Node proxy handling and `NO_PROXY` evaluation logic, including the `shouldBypassProxy` helper introduced for `no_proxy` hostname normalization and bypass checks. The issue is not that Axios ignores `NO_PROXY` entirely. Exact host exclusions work. The issue is specifically that CIDR-form exclusions are silently treated as non-matching host/domain tokens rather than as network ranges, causing the request to be proxied. This is security-relevant because CIDR notation is commonly used in container, CI, enterprise proxy, and cloud environments for ranges such as: ```text 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.169.254/32 ``` If operators rely on those entries to prevent internal or metadata-style requests from traversing a proxy, Axios may violate that expectation. PoC ```js import http from 'http'; import axios from 'axios'; function listen(server, host) { return new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, host, () => resolve(server.address().port)); }); } function close(server) { return new Promise((resolve) => server.close(resolve)); } let proxyHits = 0; let internalHits = 0; const internal = http.createServer((req, res) => { internalHits += 1; res.writeHead(200, { 'content-type': 'text/plain' }); res.end(`internal service saw ${req.url}`); }); const proxy = http.createServer((req, res) => { proxyHits += 1; res.writeHead(200, { 'content-type': 'text/plain' }); res.end(`proxy saw request for ${req.url}`); }); const internalHost = process.env.POC_INTERNAL_HOST || '127.0.0.2'; const proxyHost = process.env.POC_PROXY_HOST || '127.0.0.1'; let internalPort; let proxyPort; try { internalPort = await listen(internal, internalHost); proxyPort = await listen(proxy, proxyHost); } catch (error) { console.error('Failed to bind local PoC servers.'); console.error('On some systems 127.0.0.2 is unavailable; try:'); console.error(' POC_INTERNAL_HOST=127.0.0.1 node poc-no-proxy-cidr-axios.mjs'); console.error(''); throw error; } const targetUrl = `http://${internalHost}:${internalPort}/metadata`; const proxyUrl = `http://${proxyHost}:${proxyPort}`; const noProxy = process.env.POC_NO_PROXY || '127.0.0.0/8'; process.env.http_proxy = proxyUrl; process.env.HTTP_PROXY = proxyUrl; process.env.no_proxy = noProxy; process.env.NO_PROXY = noProxy; console.log('Axios NO_PROXY CIDR full axios network PoC'); console.log(`axios VERSION=${axios.VERSION || 'unknown'}`); console.log(`NO_PROXY=${process.env.no_proxy}`); console.log(`HTTP_PROXY=${process.env.http_proxy}`); console.log(`Target URL=${targetUrl}`); console.log(''); try { const response = await axios.get(targetUrl, { timeout: 2000, }); console.log(`Response=${response.data}`); console.log(`Proxy hits=${proxyHits}`); console.log(`Internal direct hits=${internalHits}`); console.log(''); if (proxyHits > 0 && internalHits === 0) { console.log(`POC RESULT: axios sent the target through the proxy with NO_PROXY=${noProxy}.`); } else if (proxyHits === 0 && internalHits > 0) { console.log(`POC RESULT: axios bypassed the proxy with NO_PROXY=${noProxy}.`); } else { console.log('POC RESULT: mixed/ambiguous routing; inspect counts above.'); } } finally { delete process.env.http_proxy; delete process.env.HTTP_PROXY; delete process.env.no_proxy; delete process.env.NO_PROXY; await close(proxy); await close(internal); } ``` Run the failing CIDR case: ```bash POC_INTERNAL_HOST=127.0.0.1 node poc-no-proxy-cidr-axios.mjs ``` Observed: ```text Axios NO_PROXY CIDR full axios network PoC axios VERSION=1.17.0 NO_PROXY=127.0.0.0/8 HTTP_PROXY=http://127.0.0.1:34315 Target URL=http://127.0.0.1:43993/metadata Response=proxy saw request for http://127.0.0.1:43993/metadata Proxy hits=1 Internal direct hits=0 POC RESULT: axios sent the target through the proxy with NO_PROXY=127.0.0.0/8. ``` Control Axios does honor exact IP `NO_PROXY` entries: ```bash POC_INTERNAL_H…