Node.js Module axios 0.31.1 < 0.33.0 / 1.15.2 < 1.18.0 Proxy Hijacking (CVE-2026-67320)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(333250);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/07");

  script_cve_id("CVE-2026-67320");
  script_cwe_id(200);

  script_name(english:"Node.js Module axios 0.31.1 < 0.33.0 / 1.15.2 < 1.18.0 Proxy Hijacking (CVE-2026-67320)");

  script_set_attribute(attribute:"synopsis", value:
"A module in the Node.js JavaScript run-time environment is affected by a proxy hijacking vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of the axios Node.js module installed on the remote host is 0.31.1 prior to 0.33.0 or 1.15.2 prior to
1.18.0. It is, therefore, affected by a vulnerability:

  - axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled
    proxy. Request interceptors run after the merge and a common immutable interceptor pattern converts the
    hardened config back into a regular object. The Node HTTP adapter then reads config.proxy through the
    prototype chain, allowing an attacker who can pollute Object.prototype.proxy to observe Authorization
    headers, Basic auth, and request bodies on plaintext HTTP requests. (CVE-2026-67320)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8837c61e");
  script_set_attribute(attribute:"solution", value:
"Upgrade to axios version 0.33.0 / 1.18.0 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-67320");

  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:axios:axios");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("installed_sw/Node.js", "Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

var app_info = vcf_extras::nodejs_modules::get_app_info(app:'axios');

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, 'axios');

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  { 'min_version' : '0.31.1', 'fixed_version' : '0.33.0' },
  { 'min_version' : '1.15.2', 'fixed_version' : '1.18.0' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);