social media network

adult content

healthcare medical

news media journalism

phishing scam

English

The domain 'facebook-sigma-ruby.vercel.app' uses the application-focused generic top-level domain (.app) with subdomain 'facebook-sigma-ruby'. The core label 'vercel' covers 6 characters with two vowels and four consonants. It segments into 2 words: ver, cel. Median word length comes out to 3 characters. No strong language cues emerged from the frequency lists.

html/3f/33/3f331433-3848-40b5-b3dc-259cefe0d052.html.gz

57d1988ea6a43d6e0226f2513398d5acf2c6006b4df8a9e34e95d2f57774fc4f

449b4f963f804c6228b233c7d08386c6eedba6d1a3d69994ad024405e27e6597

97cb880a43f5e6d90b3882adcbc46f6f04d11fbe17b7be981e9676f05c4beb58

8ad11c4cb079bba93156727270f510292eedcc0716c6f21725074a59ec8b9b96

de2511864b48b3a371a9c789a9cf624b3bcde628fb6572b6b936a5cc2c48c26f

0833b2e9c3a26c258476c46266e6877fc75218625162e0460be9a3a098a61c6c

986ec4b4c2a0129f63679e4b3446da2a0f562c19f6be4a336c43cd07e8be3048

axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

## Summary

When Axios runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response.
This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`.

# Denial of Service via **proto** Key in mergeConfig

### Summary

The `mergeConfig` function in axios crashes with a TypeError when processing configuration objects containing `__proto__` as an own property. An attacker can trigger this by providing a malicious configuration object created via `JSON.parse()`, causing complete denial of service.

### Details

The vulnerability exists in `lib/core/mergeConfig.js` at lines 98-101:

```javascript
utils.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) {
  const merge = mergeMap[prop] || mergeDeepProperties;
  const configValue = merge(config1[prop], config2[prop], prop);
  (utils.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
});
```

When `prop` is `'__proto__'`:

1. `JSON.parse('{"__proto__": {...}}')` creates an object with `__proto__` as an own enumerable property
2. `Object.keys()` includes `'__proto__'` in the iteration
3. `mergeMap['__proto__']` performs prototype chain lookup, returning `Object.prototype` (truthy object)
4. The expression `mergeMap[prop] || mergeDeepProperties` evaluates to `Object.prototype`
5. `Object.prototype(...)` throws `TypeError: merge is not a function`

The `mergeConfig` function is called by:

- `Axios._request()` at `lib/core/Axios.js:75`
- `Axios.getUri()` at `lib/core/Axios.js:201`
- All HTTP method shortcuts (`get`, `post`, etc.) at `lib/core/Axios.js:211,224`

### PoC

```javascript
import axios from "axios";

const maliciousConfig = JSON.parse('{"__proto__": {"x": 1}}');
await axios.get("https://httpbin.org/get", maliciousConfig);
```

**Reproduction steps:**

1. Clone axios repository or `npm install axios`
2. Create file `poc.mjs` with the code above
3. Run: `node poc.mjs`
4. Observe the TypeError crash

**Verified output (axios 1.13.4):**

```
TypeError: merge is not a function
    at computeConfigValue (lib/core/mergeConfig.js:100:25)
    at Object.forEach (lib/utils.js:280:10)
    at mergeConfig (lib/core/mergeConfig.js:98:9)
```

**Control tests performed:**
| Test | Config | Result |
|------|--------|--------|
| Normal config | `{"timeout": 5000}` | SUCCESS |
| Malicious config | `JSON.parse('{"__proto__": {"x": 1}}')` | **CRASH** |
| Nested object | `{"headers": {"X-Test": "value"}}` | SUCCESS |

**Attack scenario:**
An application that accepts user input, parses it with `JSON.parse()`, and passes it to axios configuration will crash when receiving the payload `{"__proto__": {"x": 1}}`.

### Impact

**Denial of Service** - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

- Node.js servers using axios for HTTP requests
- Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Requests	IP Address	Location	AS Autonomous System
5	104.17.208.5Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	104.17.24.14Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	172.64.147.188Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	216.198.79.195	United States	AS16509Amazon.com, Inc.
17	4	-	-

Security Scan Report: facebook-sigma-ruby.vercel.app

Summary

AI Security Verdict

High Risk

Risk Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History