A real run on a demo repo (acme/checkout-web)

Showing final run state

#security-war-room acme/checkout-web

Dependabot bot 10:42

2 new alerts on acme/checkout-web
• axios 0.27.2 CVE-2023-45857 Medium (6.5)
• lodash 4.17.20 CVE-2021-23337 High (7.2)

Meera 10:42

@cve-analyst are these real for us?

@cve-analyst Agent 10:43

Checked both against src/ (41 files).

lodash CVE-2021-23337: NOT REACHABLE. The flaw is in _.template. lodash is imported in 6 files and we use debounce, get and isEqual. No template, lodash/template or lodash.template anywhere. Bump to 4.17.21 in the next routine update.

axios CVE-2023-45857: REACHABLE. src/api/client.js:42 creates the shared instance with withCredentials: true, and src/api/rates.js:9 calls partner-rates.example.com, a different origin. On 0.27.2 that attaches the XSRF token header to the cross-origin request. Fixed in 1.6.0 (0.28.0 on the 0.x line). @patch-crafter this one is yours.

@patch-crafter Agent 10:44

On it. Branch fix/axios-cve-2023-45857, axios 0.27.2 -> 1.6.8.

@patch-crafter Agent 10:53

Test run 1: 11 failed, 7 passed. SyntaxError: Cannot use import statement outside a module (axios 1.x ships ESM, our Jest is CommonJS). Fix: mapped axios to its CJS build in jest.config.js. Also replaced deprecated axios.all / axios.spread in checkout.js with Promise.all.

Test run 2: 18 passed, 18 total. Rescan: axios advisory resolved, no new advisories. Draft PR #23, 3 files, +7 -4. @meera I need your sign-off before I mark it ready for review.

                            PR #23: Upgrade axios to 1.6.8 (fix CVE-2023-45857)
                          

Draft #23

                          Branch: fix/axios-cve-2023-45857 · 3 files changed · +7 -4
                        

Meera 10:58

Read the diff. Approved.

@patch-crafter Agent 10:58

Marked #23 ready for review and linked this thread in the description.

Demo repo and sample data. The CVEs are real.

                src/api/client.js
                Line 42 highlighted
              

import axios from 'axios';
import { API_BASE_URL } from '../config';
/**
 * Shared HTTP client for checkout requests
 */
export const apiClient = axios.create({
  withCredentials: true, // CVE-2023-45857 trigger sink
  baseURL: API_BASE_URL,
  timeout: 10000,
  headers: {
    'Content-Type': 'application/json',
    'X-Requested-With': 'XMLHttpRequest'
  }
});
// Used across 18 routes in checkout-web

Proof

The change: 3 files, +7 -4 git diff

package.json:
- "axios": "^0.27.2",+ "axios": "^1.6.8",
jest.config.js:
+ moduleNameMapper: { '^axios$': 'axios/dist/browser/axios.cjs', },
src/api/checkout.js:
- export function getCheckoutTotals(cart) {+ export async function getCheckoutTotals(cart) {
- return axios.all([getRates(cart, headers), getTax(cart, headers)])
-   .then(axios.spread((rates, tax) => ({ rates, tax })));
+ const [rates, tax] = await Promise.all([getRates(cart, headers), getTax(cart, headers)]);
+ return { rates, tax };

Sandbox Test Verification Click tab to inspect runs

PASS src/api/checkout.test.js

PASS src/api/rates.test.js

PASS src/api/client.test.js

Test Suites: 6 passed, 6 total / Tests: 18 passed, 18 total

Time: 0.814s · All suites green

Triage Table acme/checkout-web

Alert	Package	Reachable	Evidence	Action
`CVE-2023-45857`	axios 0.27.2	Yes	`client.js:42, rates.js:9`	Patched to 1.6.8 in PR #23
`CVE-2021-23337`	lodash 4.17.20	No	No template call sites in 41 files	Deferred; bump to 4.17.21 with next routine update