CVE-2023-45857

MEDIUM LAB

Axios 1.5.1 - Sensitive Information Exposure via X-XSRF-TOKEN Header

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2023-45857. PoCs published by fuyuooumi1027, intercept6, valentin-panov.

AI-analyzed exploit summary This repository demonstrates CVE-2023-45857, an axios vulnerability involving improper handling of XSRF tokens. It includes a Docker-based setup to simulate the attack scenario, confirming the presence of the XSRF-TOKEN cookie and its transmission in headers.

Description

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Exploits (3)

nomisec WORKING POC 1 stars
by fuyuooumi1027 · poc
https://github.com/fuyuooumi1027/CVE-2023-45857-Demo

This repository demonstrates CVE-2023-45857, an axios vulnerability involving improper handling of XSRF tokens. It includes a Docker-based setup to simulate the attack scenario, confirming the presence of the XSRF-TOKEN cookie and its transmission in headers.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: axios (versions affected by CVE-2023-45857)
No auth needed
Prerequisites: Docker environment · Browser with developer tools
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by intercept6 · poc
https://github.com/intercept6/CVE-2023-45857-Demo

This repository demonstrates CVE-2023-45857, an axios vulnerability involving improper handling of XSRF tokens. It includes a Docker-based setup to simulate the attack scenario, confirming the presence of the XSRF-TOKEN cookie and its transmission in headers.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: axios (versions affected by CVE-2023-45857)
No auth needed
Prerequisites: Docker environment · Browser with developer tools
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec STUB
by valentin-panov · poc
https://github.com/valentin-panov/CVE-2023-45857

The repository contains minimal code with no functional exploit or technical details related to CVE-2023-45857. The provided files are boilerplate Next.js components and API endpoints without any exploit logic.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 6.5
EPSS 0.0024
EPSS Percentile 47.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Lab Environment

COMMUNITY
Community Lab
docker pull mcr.microsoft.com/devcontainers/typescript-node:1-20-bookworm
docker pull traefik/whoami

Details

CWE
CWE-352
Status published
Products (2)
axios/axios 1.5.1
npm/axios 1.0.0 - 1.6.0npm
Published Nov 08, 2023
Tracked Since Feb 18, 2026