Spanish

Within the German country-code top-level domain (.de), 'cproter.de' is registered and has no subdomain. Count 7 characters in 'cproter' with two vowels and 5 consonants. Word splitting yields 2 words: cp, roter. Expect 3.5 characters per word on average. No strong language cues emerged from the frequency lists.

ade9795e18be01f205e1a650783410fd48059e768668c95cf7f7e7d070f97b9e

2cb2eb920c5a9ec89e4ded27482767a1fa4825ba49f70088406af3a05d6bfd69

1807bda352e3e14b5e1b75be2463bbb10d77e7d893ef510eb439e6614eff32c3

9ffea23aa0683fef1a205d924cc331e45270fce06bb8f8b117cdae1b2eebc2cf

b9ecabaabf25f2bbceb0c2eabaff77ed61f69c29ce551b1a8ac7156f87108cf4

Axios Cross-Site Request Forgery Vulnerability

Versions before 1.6.8 depends on follow-redirects before 1.15.6 which could leak the proxy authentication credentials

axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

When Axios runs on Node.js and is given a data: scheme URL, it decodes the entire payload into memory and returns a synthetic 200 response, ignoring maxContentLength and maxBodyLength limits. An attacker can supply a very large data: URI to cause unbounded memory allocation and crash the process, constituting a Denial of Service.

The mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property, such as those created via JSON.parse. An attacker who can pass a JSON payload with __proto__ as a config key can trigger a complete Denial of Service.

Axios does not correctly normalize hostnames when checking NO_PROXY rules, causing requests to loopback addresses with a trailing dot (localhost.) or IPv6 literals ([::1]) to bypass NO_PROXY matching and be routed through the configured proxy. Attackers controlling request URLs can exploit this to bypass SSRF mitigations and reach sensitive loopback or internal services.

Axios is vulnerable to being used as a gadget in a prototype pollution attack chain: when Object.prototype is polluted with CRLF-containing header values via another dependency, Axios merges the polluted properties into request headers without sanitization. This allows HTTP request smuggling attacks including bypassing AWS IMDSv2 session token requirements to steal cloud credentials.

Axios is vulnerable to CRLF injection via the Content-Type header in multipart form-data requests. When constructing per-part headers for binary or Blob-like values, value.type is interpolated without sanitizing CRLF sequences, allowing an attacker who controls the MIME type of an uploaded file to inject arbitrary headers into the multipart body.

Axios does not enforce maxBodyLength for stream request bodies when maxRedirects is set to 0, because the native HTTP transport path used in that configuration does not perform byte counting. Oversized streamed uploads are sent in full despite the configured body size limit, enabling uncontrolled upstream data transfer and potential resource exhaustion.

The toFormData helper in Axios recursively walks nested objects without a depth limit or try/catch protection. An attacker who can provide a deeply nested object as request data or params can trigger a stack overflow, crashing the Node.js request handler or process.

Axios is vulnerable to a prototype pollution gadget that allows header injection in the Node.js HTTP adapter. When Object.prototype is polluted with duck-typed FormData properties including getHeaders, Axios treats any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging arbitrary headers into the outgoing request.

The fix for the NO_PROXY hostname normalization bypass (GHSA-3p68-rc4w-qgx5) is incomplete: shouldBypassProxy() does not resolve loopback address equivalents. When NO_PROXY=localhost is set, requests to 127.0.0.1 and [::1] are still routed through the configured proxy, enabling SSRF bypasses against internal services.

Axios has multiple prototype pollution gadgets where config properties are read without hasOwnProperty guards. When Object.prototype is polluted by a co-dependency, an attacker can silently intercept and modify every JSON response (parseReviver gadget) or fully hijack the underlying HTTP transport to intercept credentials and headers (transport gadget).

The Axios 1.15.0 patch for NO_PROXY hostname normalization is incomplete: the isLoopback() function only recognizes three specific addresses (localhost, 127.0.0.1, ::1) but not the full RFC 1122 loopback subnet 127.0.0.0/8. Requests to any 127.x.x.x address other than 127.0.0.1 bypass NO_PROXY matching and are routed through the configured proxy, enabling SSRF.

Axios does not enforce maxContentLength when responseType is set to 'stream'. The response stream is returned directly without byte-counting, allowing unbounded downstream consumption of arbitrarily large server responses despite the configured limit.

Axios is vulnerable to a prototype pollution gadget via the validateStatus config property, which uniquely uses the JavaScript in operator (which traverses the prototype chain) during config merging. When Object.prototype.validateStatus is polluted with () => true, all HTTP error responses (401, 403, 500, etc.) are silently treated as successes, bypassing authentication and error handling.

The encode() function in Axios's AxiosURLSearchParams helper contains a character map entry that reverses the safe percent-encoding of null bytes: '%00' is mapped back to a raw null byte '\x00' after encodeURIComponent has correctly encoded it. Applications using AxiosURLSearchParams directly without an external encoder will produce URLs containing raw null bytes, which can cause truncation or WAF bypass in downstream C-based parsers.

Axios's XSRF token protection uses truthy/falsy semantics rather than strict boolean comparison for the withXSRFToken config property. When Object.prototype is polluted with any truthy non-boolean value for withXSRFToken, the same-origin check is bypassed and the XSRF token is sent to all cross-origin destinations, enabling CSRF attacks after token theft.

Axios contains prototype pollution gadgets in request config processing; a polluted Object.prototype.transformResponse can be executed with access to request credentials and response data, enabling credential theft and response hijacking across all requests.

Axios is vulnerable to a prototype pollution gadget via the parseReviver configuration property. When Object.prototype.parseReviver is polluted, Axios uses the attacker-controlled function as a JSON.parse reviver on every response, enabling silent selective modification of JSON values (e.g. privilege escalation) and exfiltration of all response data including API keys.

Axios has five config properties (auth, baseURL, socketPath, beforeRedirect, insecureHTTPParser) that are read from the merged config object without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted, these properties enable credential injection, request hijacking to attacker-controlled servers, SSRF via Unix sockets, and arbitrary code execution via redirect callbacks.

Axios is vulnerable to a prototype pollution gadget attack where a polluted Object.prototype.proxy causes all HTTP requests to be routed through an attacker-controlled proxy, enabling full man-in-the-middle attacks including credential interception.

Axios 1.15.2 exposes two prototype pollution gadgets: HTTP header injection via utils.merge() building plain objects that walk the prototype chain, and a crash DoS where a polluted Object.prototype.get or .set causes TypeError on every axios request.

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Axios: Excessive recursion in formDataToJSON can cause denial of service

Axios: Nested axios option objects can consume polluted prototype values

Axios: Prototype pollution gadgets can alter axios request construction

Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

Axios: Header Injection via Inherited headers After Minimal Interceptor

8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762

cac9e3e4ca7d69d473a57ca16c65b66137544a975aa628271f7679edb32ae86f

5d6cd2509f85210dfc76a0b4ebfe3cb0d470535421dff69f8e6274f344a7780f

9cfdb93f38afcf2d076abecd66d32bfd3383cdf1967654ebc26a26605daf4173

76eb1ed53083b74d1cc031c07b235c45148b83e6f507dc0f05626a641eda0e1b

b613087b9ba89150fd86e9a01f4bc0046b77cee335083296f23e27f3357160ee

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

Requests	IP Address	Location	AS Autonomous System
7	125.230.72.175	Dacun, Changhua, Taiwan	AS3462Data Communication Business Group
6	54.192.35.5Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
6	202.168.180.27	China	AS58834Guangdong Cable Corporation Limited
0	3	-	-

Security Scan Report: cproter.de

Summary

AI Security Verdict

High Risk

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies1

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History