org.webjars.npm:angular@1.5.5 vulnerabilities

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input in the srcset attribute, which allows bypassing the imgSrcSanitizationTrustedUrlList allowlist. An attacker can manipulate the content presented to other users by setting a srcset value to retrieve data from an unintended domain.

There is no fixed version for org.webjars.npm:angular.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Incomplete Filtering of Special Elements. The srcset attribute in an HTML <source> element can be a vector for content spoofing. An attacker can manipulate the content presented to other users by interpolating a srcset value directly that doesn't comply with image source restrictions, or by using the ngAttrSrcset directive.

Note: The ngSrcset and ngPropSrcset directives are not attack vectors for this vulnerability.

There is no fixed version for org.webjars.npm:angular.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service.

Note:

This package is EOL and will not receive any updates to address this issue. Users should migrate to @angular/core.

There is no fixed version for org.webjars.npm:angular.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

There is no fixed version for org.webjars.npm:angular.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

There is no fixed version for org.webjars.npm:angular.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

There is no fixed version for org.webjars.npm:angular.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.

There is no fixed version for org.webjars.npm:angular.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). XSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to JQLite methods like JQLite.prepend, JQLite.after, JQLite.append, JQLite.replaceWith, JQLite.append, new JQLite and angular.element.

JQLite (DOM manipulation library that's part of AngularJS) manipulates input HTML before inserting it to the DOM in jqLiteBuildFragment.

One of the modifications performed expands an XHTML self-closing tag.

If jqLiteBuildFragment is called (e.g. via new JQLite(aString)) with user-controlled HTML string that was sanitized (e.g. with DOMPurify), the transformation done by JQLite may modify some forms of an inert, sanitized payload into a payload containing JavaScript - and trigger an XSS when the payload is inserted into DOM.

PoC

const inertPayload = `<div><style><style/><img src=x onerror="alert(1337)"/>` 

Note that the style element is not closed and <img would be a text node inside the style if inserted into the DOM as-is. As such, some HTML sanitizers would leave the <img as is without processing it and stripping the onerror attribute.

angular.element(document).append(inertPayload);

This will alert, as <style/> will be replaced with <style></style> before adding it to the DOM, closing the style element early and reactivating img.

Upgrade org.webjars.npm:angular to version 1.8.0 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping <option> elements in <select> ones changes parsing behavior, leading to possibly unsanitizing code.

Upgrade org.webjars.npm:angular to version 1.8.0 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Prototype Pollution. The function merge() could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.

Upgrade org.webjars.npm:angular to version 1.7.9 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Denial of Service (DoS). None

Upgrade org.webjars.npm:angular to version 1.6.3 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). None

Upgrade org.webjars.npm:angular to version 1.6.5 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The $http service allows JSONP requests with untrusted URLs, which could be exploited by an attacker.

Upgrade org.webjars.npm:angular to version 1.6.0-rc.2 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through SVG files if enableSvg is set.

Upgrade org.webjars.npm:angular to version 1.6.9 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Browsers mutate attributes values such as 　javascript:alert(1) when they are written to the DOM via innerHTML in various vendor specific ways. In Chrome (<62), this mutation removed the preceding "whitespace" resulting in a value that could end up being executed as JavaScript.

Here is an example of what could happen:

// Code goes here
var h1 = document.querySelector('h1');
h1.innerHTML = '<a href="&#x3000;javascript:alert(1)">CLICKME</a>';
var innerHTML = h1.innerHTML;
console.log(innerHTML);
h1.innerHTML = innerHTML;

The sanitizer contains a bit of code that triggers this mutation on an inert piece of DOM, before angular sanitizes it.

Note: Chrome 62 does not appear to mutate this particular string any more, instead it just leaves the "whitespace" in place. This probably means that Chrome 62 is no longer vulnerable to this specific attack vector.

Upgrade org.webjars.npm:angular to version 1.6.7 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to JSONP Callback Attack. JSONP (JSON with padding) is a method used to request data from a server residing in a different domain than the client.

Any url could perform JSONP requests, allowing full access to the browser and the JavaScript context. This can lead to Cross-site Scripting.

Upgrade org.webjars.npm:angular to version 1.6.1 or higher.

org.webjars.npm:angular is a WebJar for angular.

Affected versions of this package are vulnerable to Content Security Policy (CSP) Bypass. Extension URIs (resource://...) bypass Content-Security-Policy in Chrome and Firefox and can always be loaded. Now if a site already has a XSS bug, and uses CSP to protect itself, but the user has an extension installed that uses Angular, an attacker can load Angular from the extension, and Angular's auto-bootstrapping can be used to bypass the victim site's CSP protection.

Upgrade org.webjars.npm:angular to version 1.5.9 or higher.