[CVE-2023-45857] Axios Cross-Site Request Forgery Vulnerability in transitive dependency

[patricknick]

What happened?

Github currently reports a vulnerability for Axios on the versions >= 0.8.1, < 1.6.0. Axios is used in adal-node, a transitive dependency of azure/ms-rest-nodeauth, which again is used by pulumi/azure.

When investigating the dependency chain, I noticed that adal-node is no longer maintained. azure/ms-rest-nodeauth is also not longer actively developed and is not planning to removed adal-node. See Azure/ms-rest-nodeauth#128. Instead, they suggest to migrate to @azure/identity.

This is blocking us from addressing the initial Axios security warning. Do you have plans to migrate away from azure/ms-rest-nodeauth?

Example

N/A

Output of pulumi about

N/A

Additional context

Affects @pulumi/azure v5.55.0

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[mikhailshilkov]

Yes, thank you for bringing this up, we use that dependency in our callback function mixins. Any chance you have bandwidth to try to open a PR for such an upgrade?

[levpachmanov]

Hey @patricknick @mikhailshilkov,
We're part of a startup called Seal Security that mitigates software vulnerabilities in older open source versions by backporting/creating standalone security patches - enabling more straightforward remediation in cases like this. We created an axios 0.27.2-sp1 that's vulnerability-free. As with all of our patches, it's open-source and available for free.

If relevant, check out our GitHub repo if you wish to learn more, or start using our app.

Please feel free to reach us at [email protected] if you have any requests/questions.

[patricknick]

@mikhailshilkov I looked briefly into the required upgrade steps to @azure/identity. Most of it does seem straight-forward, there is a migration guide available.

However, the new package is constructed a bit differently from the old one, meaning, not all options that Pulumi uses (for example ARM_MSI_ENDPOINT) are available anymore. I think a bit of knowledge about Azure Identity Management and the Pulumi codebase is required to make this change solid. Unfortunately, I don't know either, and the required ramp up does exceed my bandwidth at the moment. Or do you have any resources that could help with this?

[pulumi-bot]

This issue has been addressed in PR #2225 and shipped in release v5.84.0.