Axios Proxy Credential Exposure in Redirect Flows

Axios, a widely-used HTTP client library for Node.js and browsers, contains a critical credential leakage vulnerability in its HTTP adapter. When an authenticated request is sent through an HTTP proxy and then redirected to a non-proxied origin, the Proxy-Authorization header may be forwarded to the final destination, exposing proxy credentials to untrusted servers. This affects any Node.js application using Axios versions before 0.32.0 or 1.16.0 that relies on authenticated proxy infrastructure, particularly in enterprise environments where HTTP proxies enforce network security policies. The vulnerability is classified as CWE-201 (Exposure of Sensitive Information Through Output), representing a direct information disclosure risk that could compromise proxy authentication credentials used across an organization's infrastructure.

While this CVE maps to no specific MITRE ATT&CK techniques (reflecting its nature as a library-level credential exposure rather than an exploitation technique), Casky's security skills would identify attack patterns associated with credential harvesting and lateral movement. Practitioners using Casky's extended reasoning capabilities would detect suspicious HTTP traffic flows showing credential headers reaching unexpected destinations, or anomalous redirect chains that transition from authenticated to unauthenticated contexts. By analyzing request/response patterns across Axios client implementations, security teams would recognize the hallmarks of this vulnerability: initial proxy-authenticated requests followed by Location headers pointing to external origins, with corresponding credential leakage in downstream connections. This detection approach aligns with the Casky platform's ability to map behavioral indicators to the underlying technical flaws, enabling rapid patching and mitigation before proxy credentials are compromised in the wild.