org.webjars.npm:angular@1.4.5 vulnerabilities

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input in the srcset attribute, which allows bypassing the imgSrcSanitizationTrustedUrlList allowlist. An attacker can manipulate the content presented to other users by setting a srcset value to retrieve data from an unintended domain.

There is no fixed version for org.webjars.npm:angular.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Incomplete Filtering of Special Elements. The srcset attribute in an HTML <source> element can be a vector for content spoofing. An attacker can manipulate the content presented to other users by interpolating a srcset value directly that doesn't comply with image source restrictions, or by using the ngAttrSrcset directive.

Note: The ngSrcset and ngPropSrcset directives are not attack vectors for this vulnerability.

There is no fixed version for org.webjars.npm:angular.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service.

Note:

This package is EOL and will not receive any updates to address this issue. Users should migrate to @angular/core.

There is no fixed version for org.webjars.npm:angular.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

There is no fixed version for org.webjars.npm:angular.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

There is no fixed version for org.webjars.npm:angular.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.

There is no fixed version for org.webjars.npm:angular.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). XSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to JQLite methods like JQLite.prepend, JQLite.after, JQLite.append, JQLite.replaceWith, JQLite.append, new JQLite and angular.element.

JQLite (DOM manipulation library that's part of AngularJS) manipulates input HTML before inserting it to the DOM in jqLiteBuildFragment.

One of the modifications performed expands an XHTML self-closing tag.

If jqLiteBuildFragment is called (e.g. via new JQLite(aString)) with user-controlled HTML string that was sanitized (e.g. with DOMPurify), the transformation done by JQLite may modify some forms of an inert, sanitized payload into a payload containing JavaScript - and trigger an XSS when the payload is inserted into DOM.

PoC

const inertPayload = `<div><style><style/><img src=x onerror="alert(1337)"/>` 

Note that the style element is not closed and <img would be a text node inside the style if inserted into the DOM as-is. As such, some HTML sanitizers would leave the <img as is without processing it and stripping the onerror attribute.

angular.element(document).append(inertPayload);

This will alert, as <style/> will be replaced with <style></style> before adding it to the DOM, closing the style element early and reactivating img.

Upgrade org.webjars.npm:angular to version 1.8.0 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping <option> elements in <select> ones changes parsing behavior, leading to possibly unsanitizing code.

Upgrade org.webjars.npm:angular to version 1.8.0 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Denial of Service (DoS). None

Upgrade org.webjars.npm:angular to version 1.6.3 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). None

Upgrade org.webjars.npm:angular to version 1.6.5 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The $http service allows JSONP requests with untrusted URLs, which could be exploited by an attacker.

Upgrade org.webjars.npm:angular to version 1.6.0-rc.2 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through SVG files if enableSvg is set.

Upgrade org.webjars.npm:angular to version 1.6.9 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Browsers mutate attributes values such as 　javascript:alert(1) when they are written to the DOM via innerHTML in various vendor specific ways. In Chrome (<62), this mutation removed the preceding "whitespace" resulting in a value that could end up being executed as JavaScript.

Here is an example of what could happen:

// Code goes here
var h1 = document.querySelector('h1');
h1.innerHTML = '<a href="&#x3000;javascript:alert(1)">CLICKME</a>';
var innerHTML = h1.innerHTML;
console.log(innerHTML);
h1.innerHTML = innerHTML;

The sanitizer contains a bit of code that triggers this mutation on an inert piece of DOM, before angular sanitizes it.

Note: Chrome 62 does not appear to mutate this particular string any more, instead it just leaves the "whitespace" in place. This probably means that Chrome 62 is no longer vulnerable to this specific attack vector.

Upgrade org.webjars.npm:angular to version 1.6.7 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to JSONP Callback Attack. JSONP (JSON with padding) is a method used to request data from a server residing in a different domain than the client.

Any url could perform JSONP requests, allowing full access to the browser and the JavaScript context. This can lead to Cross-site Scripting.

Upgrade org.webjars.npm:angular to version 1.6.1 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to the usemap attribute not being blacklisted.

Upgrade org.webjars.npm:angular to version 1.5.0-rc.2 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the SVG <use> element. The <use> element can reference external SVG's (same origin) and can include xlink:href javascript urls or foreign object that can execute XSS. The change disallows <use> elements in sanitized SVG markup.

An example of a malicious SVG document would be:

SVG to sanitize:

<svg><use xlink:href="test.svg#xss" /></svg>

External SVG file (test.svg):

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<svg xmlns:svg="http://www.w3.org/2000/svg"
   xmlns="http://www.w3.org/2000/svg" width="100"
   height="100"
   id="xss">
<a xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="javascript:alert(1)">
  <circle cx="50" cy="50" r="40" stroke="black" stroke-width="3" fill="red" />
</a>
</svg>

Here the SVG to sanitize loads in the test.svg file via the <use> element. The sanitizer is not able to parse this file, which contains malicious executable mark-up. This can only be taken advantage of if the external file is available via the same origin restrictions in place.

Upgrade org.webjars.npm:angular to version 1.5.0-rc.0 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks involving assignment on constructor properties.

Upgrade org.webjars.npm:angular to version 1.4.10 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). This error occurs when $sanitize sanitizer tries to check the input for possible mXSS payload and the verification errors due to the input mutating indefinitely. This could be a sign that the payload contains code exploiting an mXSS vulnerability in the browser.

mXSS attack exploit browser bugs that cause some browsers parse a certain html strings into DOM, which once serialized doesn't match the original input. These browser bugs can be exploited by attackers to create payload which looks harmless to sanitizers, but due to mutations caused by the browser are turned into dangerous code once processed after sanitization.

Upgrade org.webjars.npm:angular to version 1.5.0-beta.2 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Clickjacking. By enabling the SVG setting without taking other precautions, you might expose your application to click-hijacking attacks. In these attacks, sanitized SVG elements could be positioned outside of the containing element and be rendered over other elements on the page (e.g. a login link). Such behavior can then result in phishing incidents.

To protect against these, explicitly setup overflow: hidden css rule for all potential SVG tags within the sanitized content:

.rootOfTheIncludedContent svg {
  overflow: hidden !important;
}

Upgrade org.webjars.npm:angular to version 1.5.0-beta.0 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to no proper sanitization of xlink:href attributes.

Upgrade org.webjars.npm:angular to version 1.5.0-beta.0 or higher.