angular@1.3.10 vulnerabilities

HTML enhanced for web apps

Direct Vulnerabilities

Known vulnerabilities in the angular package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Regular Expression Denial of Service (ReDoS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service.

Note:

This package is EOL and will not receive any updates to address this issue. Users should migrate to @angular/core.

How to fix Regular Expression Denial of Service (ReDoS)?

There is no fixed version for angular.

>=1.3.0
  • M
Regular Expression Denial of Service (ReDoS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

How to fix Regular Expression Denial of Service (ReDoS)?

There is no fixed version for angular.

>=1.2.21
  • M
Regular Expression Denial of Service (ReDoS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

How to fix Regular Expression Denial of Service (ReDoS)?

There is no fixed version for angular.

>=1.0.0
  • M
Cross-site Scripting (XSS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.

How to fix Cross-site Scripting (XSS)?

There is no fixed version for angular.

*
  • H
Cross-site Scripting (XSS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). XSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to JQLite methods like JQLite.prepend, JQLite.after, JQLite.append, JQLite.replaceWith, JQLite.append, new JQLite and angular.element.

JQLite (DOM manipulation library that's part of AngularJS) manipulates input HTML before inserting it to the DOM in jqLiteBuildFragment.

One of the modifications performed expands an XHTML self-closing tag.

If jqLiteBuildFragment is called (e.g. via new JQLite(aString)) with user-controlled HTML string that was sanitized (e.g. with DOMPurify), the transformation done by JQLite may modify some forms of an inert, sanitized payload into a payload containing JavaScript - and trigger an XSS when the payload is inserted into DOM.

PoC

const inertPayload = `<div><style><style/><img src=x onerror="alert(1337)"/>` 

Note that the style element is not closed and <img would be a text node inside the style if inserted into the DOM as-is. As such, some HTML sanitizers would leave the <img as is without processing it and stripping the onerror attribute.

angular.element(document).append(inertPayload);

This will alert, as <style/> will be replaced with <style></style> before adding it to the DOM, closing the style element early and reactivating img.

How to fix Cross-site Scripting (XSS)?

Upgrade angular to version 1.8.0 or higher.

<1.8.0
  • M
Cross-site Scripting (XSS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping <option> elements in <select> ones changes parsing behavior, leading to possibly unsanitizing code.

How to fix Cross-site Scripting (XSS)?

Upgrade angular to version 1.8.0 or higher.

<1.8.0
  • M
Denial of Service (DoS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Denial of Service (DoS). None

How to fix Denial of Service (DoS)?

Upgrade angular to version 1.6.3 or higher.

<1.6.3
  • M
Cross-site Scripting (XSS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). None

How to fix Cross-site Scripting (XSS)?

Upgrade angular to version 1.6.5 or higher.

<1.6.5
  • M
Cross-site Scripting (XSS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The $http service allows JSONP requests with untrusted URLs, which could be exploited by an attacker.

How to fix Cross-site Scripting (XSS)?

Upgrade angular to version 1.6.0-rc.0 or higher.

<1.6.0-rc.0
  • M
Cross-site Scripting (XSS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through SVG files if enableSvg is set.

How to fix Cross-site Scripting (XSS)?

Upgrade angular to version 1.6.9 or higher.

<1.6.9
  • M
Cross-site Scripting (XSS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Browsers mutate attributes values such as &#12288;javascript:alert(1) when they are written to the DOM via innerHTML in various vendor specific ways. In Chrome (<62), this mutation removed the preceding "whitespace" resulting in a value that could end up being executed as JavaScript.

Here is an example of what could happen:

// Code goes here
var h1 = document.querySelector('h1');
h1.innerHTML = '<a href="&#x3000;javascript:alert(1)">CLICKME</a>';
var innerHTML = h1.innerHTML;
console.log(innerHTML);
h1.innerHTML = innerHTML;

The sanitizer contains a bit of code that triggers this mutation on an inert piece of DOM, before angular sanitizes it.

Note: Chrome 62 does not appear to mutate this particular string any more, instead it just leaves the "whitespace" in place. This probably means that Chrome 62 is no longer vulnerable to this specific attack vector.

How to fix Cross-site Scripting (XSS)?

Upgrade angular to version 1.6.7 or higher.

<1.6.7
  • M
JSONP Callback Attack

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to JSONP Callback Attack. JSONP (JSON with padding) is a method used to request data from a server residing in a different domain than the client.

Any url could perform JSONP requests, allowing full access to the browser and the JavaScript context. This can lead to Cross-site Scripting.

How to fix JSONP Callback Attack?

Upgrade angular to version 1.6.1 or higher.

<1.6.1
  • M
Cross-site Scripting (XSS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to the usemap attribute not being blacklisted.

How to fix Cross-site Scripting (XSS)?

Upgrade angular to version 1.5.0-rc.2 or higher.

>=1.3.0 <1.5.0-rc.2
  • M
Cross-site Scripting (XSS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the SVG <use> element. The <use> element can reference external SVG's (same origin) and can include xlink:href javascript urls or foreign object that can execute XSS. The change disallows <use> elements in sanitized SVG markup.

An example of a malicious SVG document would be:

SVG to sanitize:

<svg><use xlink:href="test.svg#xss" /></svg>

External SVG file (test.svg):

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<svg xmlns:svg="http://www.w3.org/2000/svg"
   xmlns="http://www.w3.org/2000/svg" width="100"
   height="100"
   id="xss">
<a xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="javascript:alert(1)">
  <circle cx="50" cy="50" r="40" stroke="black" stroke-width="3" fill="red" />
</a>
</svg>

Here the SVG to sanitize loads in the test.svg file via the <use> element. The sanitizer is not able to parse this file, which contains malicious executable mark-up. This can only be taken advantage of if the external file is available via the same origin restrictions in place.

How to fix Cross-site Scripting (XSS)?

Upgrade angular to version 1.5.0-rc.0 or higher.

<1.5.0-rc.0
  • M
Cross-site Scripting (XSS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks involving assignment on constructor properties.

How to fix Cross-site Scripting (XSS)?

Upgrade angular to version 1.4.10 or higher.

<1.4.10
  • H
Cross-site Scripting (XSS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). This error occurs when $sanitize sanitizer tries to check the input for possible mXSS payload and the verification errors due to the input mutating indefinitely. This could be a sign that the payload contains code exploiting an mXSS vulnerability in the browser.

mXSS attack exploit browser bugs that cause some browsers parse a certain html strings into DOM, which once serialized doesn't match the original input. These browser bugs can be exploited by attackers to create payload which looks harmless to sanitizers, but due to mutations caused by the browser are turned into dangerous code once processed after sanitization.

How to fix Cross-site Scripting (XSS)?

Upgrade angular to version 1.5.0-beta.2 or higher.

<1.5.0-beta.2
  • M
Clickjacking

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Clickjacking. By enabling the SVG setting without taking other precautions, you might expose your application to click-hijacking attacks. In these attacks, sanitized SVG elements could be positioned outside of the containing element and be rendered over other elements on the page (e.g. a login link). Such behavior can then result in phishing incidents.

To protect against these, explicitly setup overflow: hidden css rule for all potential SVG tags within the sanitized content:

.rootOfTheIncludedContent svg {
  overflow: hidden !important;
}

How to fix Clickjacking?

Upgrade angular to version 1.5.0-beta.0 or higher.

>=1.3.1 <1.5.0-beta.0
  • H
Cross-site Scripting (XSS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to no proper sanitization of xlink:href attributes.

How to fix Cross-site Scripting (XSS)?

Upgrade angular to version 1.5.0-beta.0 or higher.

>=1.0.0 <1.5.0-beta.0
  • H
Cross-site Scripting (XSS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to no proper sanitization of xlink:href attributes.

How to fix Cross-site Scripting (XSS)?

Upgrade angular to version 1.5.0-beta.0 or higher.

>=1.0.0 <1.5.0-beta.0
  • H
Arbitrary Code Execution

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Arbitrary Code Execution via unsafe svg animation tags.

How to fix Arbitrary Code Execution?

Upgrade angular to version 1.4.0-beta.6 or higher.

<1.4.0-beta.6