angular@1.5.8 vulnerabilities

HTML enhanced for web apps

Direct Vulnerabilities

Known vulnerabilities in the angular package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Regular Expression Denial of Service (ReDoS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service.

Note:

This package is EOL and will not receive any updates to address this issue. Users should migrate to @angular/core.

How to fix Regular Expression Denial of Service (ReDoS)?

There is no fixed version for angular.

>=1.3.0
  • M
Regular Expression Denial of Service (ReDoS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

How to fix Regular Expression Denial of Service (ReDoS)?

There is no fixed version for angular.

>=1.2.21
  • M
Regular Expression Denial of Service (ReDoS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

How to fix Regular Expression Denial of Service (ReDoS)?

There is no fixed version for angular.

>=1.4.9
  • M
Regular Expression Denial of Service (ReDoS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

How to fix Regular Expression Denial of Service (ReDoS)?

There is no fixed version for angular.

>=1.0.0
  • M
Cross-site Scripting (XSS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.

How to fix Cross-site Scripting (XSS)?

There is no fixed version for angular.

*
  • H
Cross-site Scripting (XSS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). XSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to JQLite methods like JQLite.prepend, JQLite.after, JQLite.append, JQLite.replaceWith, JQLite.append, new JQLite and angular.element.

JQLite (DOM manipulation library that's part of AngularJS) manipulates input HTML before inserting it to the DOM in jqLiteBuildFragment.

One of the modifications performed expands an XHTML self-closing tag.

If jqLiteBuildFragment is called (e.g. via new JQLite(aString)) with user-controlled HTML string that was sanitized (e.g. with DOMPurify), the transformation done by JQLite may modify some forms of an inert, sanitized payload into a payload containing JavaScript - and trigger an XSS when the payload is inserted into DOM.

PoC

const inertPayload = `<div><style><style/><img src=x onerror="alert(1337)"/>` 

Note that the style element is not closed and <img would be a text node inside the style if inserted into the DOM as-is. As such, some HTML sanitizers would leave the <img as is without processing it and stripping the onerror attribute.

angular.element(document).append(inertPayload);

This will alert, as <style/> will be replaced with <style></style> before adding it to the DOM, closing the style element early and reactivating img.

How to fix Cross-site Scripting (XSS)?

Upgrade angular to version 1.8.0 or higher.

<1.8.0
  • M
Cross-site Scripting (XSS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping <option> elements in <select> ones changes parsing behavior, leading to possibly unsanitizing code.

How to fix Cross-site Scripting (XSS)?

Upgrade angular to version 1.8.0 or higher.

<1.8.0
  • H
Prototype Pollution

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Prototype Pollution. The function merge() could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.

How to fix Prototype Pollution?

Upgrade angular to version 1.7.9 or higher.

>=1.4.0-beta.6 <1.7.9
  • M
Denial of Service (DoS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Denial of Service (DoS). None

How to fix Denial of Service (DoS)?

Upgrade angular to version 1.6.3 or higher.

<1.6.3
  • M
Cross-site Scripting (XSS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). None

How to fix Cross-site Scripting (XSS)?

Upgrade angular to version 1.6.5 or higher.

<1.6.5
  • M
Cross-site Scripting (XSS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The $http service allows JSONP requests with untrusted URLs, which could be exploited by an attacker.

How to fix Cross-site Scripting (XSS)?

Upgrade angular to version 1.6.0-rc.0 or higher.

<1.6.0-rc.0
  • M
Cross-site Scripting (XSS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through SVG files if enableSvg is set.

How to fix Cross-site Scripting (XSS)?

Upgrade angular to version 1.6.9 or higher.

<1.6.9
  • M
Cross-site Scripting (XSS)

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Browsers mutate attributes values such as &#12288;javascript:alert(1) when they are written to the DOM via innerHTML in various vendor specific ways. In Chrome (<62), this mutation removed the preceding "whitespace" resulting in a value that could end up being executed as JavaScript.

Here is an example of what could happen:

// Code goes here
var h1 = document.querySelector('h1');
h1.innerHTML = '<a href="&#x3000;javascript:alert(1)">CLICKME</a>';
var innerHTML = h1.innerHTML;
console.log(innerHTML);
h1.innerHTML = innerHTML;

The sanitizer contains a bit of code that triggers this mutation on an inert piece of DOM, before angular sanitizes it.

Note: Chrome 62 does not appear to mutate this particular string any more, instead it just leaves the "whitespace" in place. This probably means that Chrome 62 is no longer vulnerable to this specific attack vector.

How to fix Cross-site Scripting (XSS)?

Upgrade angular to version 1.6.7 or higher.

<1.6.7
  • M
JSONP Callback Attack

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to JSONP Callback Attack. JSONP (JSON with padding) is a method used to request data from a server residing in a different domain than the client.

Any url could perform JSONP requests, allowing full access to the browser and the JavaScript context. This can lead to Cross-site Scripting.

How to fix JSONP Callback Attack?

Upgrade angular to version 1.6.1 or higher.

<1.6.1
  • M
Content Security Policy (CSP) Bypass

angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Content Security Policy (CSP) Bypass. Extension URIs (resource://...) bypass Content-Security-Policy in Chrome and Firefox and can always be loaded. Now if a site already has a XSS bug, and uses CSP to protect itself, but the user has an extension installed that uses Angular, an attacker can load Angular from the extension, and Angular's auto-bootstrapping can be used to bypass the victim site's CSP protection.

How to fix Content Security Policy (CSP) Bypass?

Upgrade angular to version 1.5.9 or higher.

>=1.5.0 <1.5.9