Cross-site Scripting (XSS)

Affecting angular package, versions <1.2.0

Do your applications use this vulnerable package? Test your applications

Overview

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). DOM event handlers await events to occur (e.g. onclick, onkeypress, etc) and execute arbitrary Javascript code in accordance to the event. By default, interpolations inside DOM event handlers are disallowed. Using an interpolation for such handlers means that the interpolated value is a JS string being evaluated. Storing or generating such strings is error prone and likely leads to a Cross-site Scripting (XSS) vulnerability if you're not careful. On the other hand, ng-click and such event handlers evaluate Angular expressions that are a lot safer (e.g. No direct access to global objects - only scope), cleaner and harder to exploit.

To migrate the code follow the example below: Before:

JS:   scope.foo = 'alert(1)';
HTML: <div onclick="{{foo}}">

After:

JS:   scope.foo = function() { alert(1); }
HTML: <div ng-click="foo()">

Details

Remediation

Upgrade angular to version 1.2.0 or higher.

References

CVSS Score

6.8
medium severity
  • Attack Vector
    Network
  • Attack Complexity
    High
  • Privileges Required
    None
  • User Interaction
    Required
  • Scope
    Unchanged
  • Confidentiality
    High
  • Integrity
    High
  • Availability
    None
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Credit
Chirayu Krishnappa
CWE
CWE-78
Snyk ID
npm:angular:20130621
Disclosed
20 Jun, 2013
Published
23 Jan, 2017