Cross-site Scripting (XSS) Affecting angularjs.core package, versions [,1.6.7)


0.0
medium

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    Exploit Maturity Proof of concept

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DOTNET-ANGULARJSCORE-1579457
  • published 25 Dec 2017
  • disclosed 17 Oct 2017
  • credit Unknown

Introduced: 17 Oct 2017

CVE NOT AVAILABLE CWE-79 Open this link in a new tab

How to fix?

Upgrade AngularJS.Core to version 1.6.7 or higher.

Overview

AngularJS.Core is a AngularJS.* package for other Angular modules within .NET.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Browsers mutate attributes values such as &#12288;javascript:alert(1) when they are written to the DOM via innerHTML in various vendor specific ways. In Chrome (<62), this mutation removed the preceding "whitespace" resulting in a value that could end up being executed as JavaScript.

Here is an example of what could happen:

// Code goes here
var h1 = document.querySelector('h1');
h1.innerHTML = '<a href="&#x3000;javascript:alert(1)">CLICKME</a>';
var innerHTML = h1.innerHTML;
console.log(innerHTML);
h1.innerHTML = innerHTML;

The sanitizer contains a bit of code that triggers this mutation on an inert piece of DOM, before angular sanitizes it.

Note: Chrome 62 does not appear to mutate this particular string any more, instead it just leaves the "whitespace" in place. This probably means that Chrome 62 is no longer vulnerable to this specific attack vector.

Details