org.webjars.npm:angular@1.5.11 vulnerabilities

  • latest version

    1.8.3

  • first published

    9 years ago

  • latest version published

    2 years ago

  • licenses detected

  • package manager

Direct Vulnerabilities

Known vulnerabilities in the org.webjars.npm:angular package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Regular Expression Denial of Service (ReDoS)

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service.

Note:

This package is EOL and will not receive any updates to address this issue. Users should migrate to @angular/core.

How to fix Regular Expression Denial of Service (ReDoS)?

There is no fixed version for org.webjars.npm:angular.

[1.3.0,)
  • M
Regular Expression Denial of Service (ReDoS)

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

How to fix Regular Expression Denial of Service (ReDoS)?

There is no fixed version for org.webjars.npm:angular.

[1.2.23,)
  • M
Regular Expression Denial of Service (ReDoS)

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

How to fix Regular Expression Denial of Service (ReDoS)?

There is no fixed version for org.webjars.npm:angular.

[1.4.9,)
  • M
Regular Expression Denial of Service (ReDoS)

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

How to fix Regular Expression Denial of Service (ReDoS)?

There is no fixed version for org.webjars.npm:angular.

[1.0.0,)
  • M
Cross-site Scripting (XSS)

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.

How to fix Cross-site Scripting (XSS)?

There is no fixed version for org.webjars.npm:angular.

[0,)
  • H
Cross-site Scripting (XSS)

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). XSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to JQLite methods like JQLite.prepend, JQLite.after, JQLite.append, JQLite.replaceWith, JQLite.append, new JQLite and angular.element.

JQLite (DOM manipulation library that's part of AngularJS) manipulates input HTML before inserting it to the DOM in jqLiteBuildFragment.

One of the modifications performed expands an XHTML self-closing tag.

If jqLiteBuildFragment is called (e.g. via new JQLite(aString)) with user-controlled HTML string that was sanitized (e.g. with DOMPurify), the transformation done by JQLite may modify some forms of an inert, sanitized payload into a payload containing JavaScript - and trigger an XSS when the payload is inserted into DOM.

PoC

const inertPayload = `<div><style><style/><img src=x onerror="alert(1337)"/>` 

Note that the style element is not closed and <img would be a text node inside the style if inserted into the DOM as-is. As such, some HTML sanitizers would leave the <img as is without processing it and stripping the onerror attribute.

angular.element(document).append(inertPayload);

This will alert, as <style/> will be replaced with <style></style> before adding it to the DOM, closing the style element early and reactivating img.

How to fix Cross-site Scripting (XSS)?

Upgrade org.webjars.npm:angular to version 1.8.0 or higher.

[,1.8.0)
  • M
Cross-site Scripting (XSS)

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping <option> elements in <select> ones changes parsing behavior, leading to possibly unsanitizing code.

How to fix Cross-site Scripting (XSS)?

Upgrade org.webjars.npm:angular to version 1.8.0 or higher.

[,1.8.0)
  • H
Prototype Pollution

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Prototype Pollution. The function merge() could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.

How to fix Prototype Pollution?

Upgrade org.webjars.npm:angular to version 1.7.9 or higher.

[1.4.6,1.7.9)
  • M
Denial of Service (DoS)

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Denial of Service (DoS). None

How to fix Denial of Service (DoS)?

Upgrade org.webjars.npm:angular to version 1.6.3 or higher.

[,1.6.3)
  • M
Cross-site Scripting (XSS)

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). None

How to fix Cross-site Scripting (XSS)?

Upgrade org.webjars.npm:angular to version 1.6.5 or higher.

[,1.6.5)
  • M
Cross-site Scripting (XSS)

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The $http service allows JSONP requests with untrusted URLs, which could be exploited by an attacker.

How to fix Cross-site Scripting (XSS)?

Upgrade org.webjars.npm:angular to version 1.6.0-rc.2 or higher.

[,1.6.0-rc.2)
  • M
Cross-site Scripting (XSS)

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through SVG files if enableSvg is set.

How to fix Cross-site Scripting (XSS)?

Upgrade org.webjars.npm:angular to version 1.6.9 or higher.

[,1.6.9)
  • M
Cross-site Scripting (XSS)

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Browsers mutate attributes values such as &#12288;javascript:alert(1) when they are written to the DOM via innerHTML in various vendor specific ways. In Chrome (<62), this mutation removed the preceding "whitespace" resulting in a value that could end up being executed as JavaScript.

Here is an example of what could happen:

// Code goes here
var h1 = document.querySelector('h1');
h1.innerHTML = '<a href="&#x3000;javascript:alert(1)">CLICKME</a>';
var innerHTML = h1.innerHTML;
console.log(innerHTML);
h1.innerHTML = innerHTML;

The sanitizer contains a bit of code that triggers this mutation on an inert piece of DOM, before angular sanitizes it.

Note: Chrome 62 does not appear to mutate this particular string any more, instead it just leaves the "whitespace" in place. This probably means that Chrome 62 is no longer vulnerable to this specific attack vector.

How to fix Cross-site Scripting (XSS)?

Upgrade org.webjars.npm:angular to version 1.6.7 or higher.

[,1.6.7)
  • M
JSONP Callback Attack

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to JSONP Callback Attack. JSONP (JSON with padding) is a method used to request data from a server residing in a different domain than the client.

Any url could perform JSONP requests, allowing full access to the browser and the JavaScript context. This can lead to Cross-site Scripting.

How to fix JSONP Callback Attack?

Upgrade org.webjars.npm:angular to version 1.6.1 or higher.

[,1.6.1)