Content Security Policy (CSP) Bypass

Affecting angular package, versions <1.5.9 >=1.5.0

Do your applications use this vulnerable package? Test your applications

Overview

angular is an open-source JavaScript framework, maintained by Google, that assists with running single-page applications with the goal of making development and testing easier by augmenting browser-based applications with model–view–controller (MVC) capability.

Affected versions of the package are vulnerable to CSP Bypass. Extension URIs (resource://...) bypass Content-Security-Policy in Chrome and Firefox and can always be loaded. Now if a site already has a XSS bug, and uses CSP to protect itself, but the user has an extension installed that uses Angular, an attacker can load Angular from the extension, and Angular's auto-bootstrapping can be used to bypass the victim site's CSP protection.

Remediation

Upgrade angular to version 1.5.9 or higher.

References

CVSS Score

6.5
medium severity
  • Attack Vector
    Network
  • Attack Complexity
    High
  • Privileges Required
    None
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    High
  • Integrity
    Low
  • Availability
    None
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Credit
Martin Probst
CWE
CWE-284
Snyk ID
npm:angular:20161101
Disclosed
31 Oct, 2016
Published
23 Jan, 2017