Angular, Stored Cross-Site Scripting (XSS), (Critical)

By /

Listen to this Post

The vulnerability exists in the Angular Template Compiler due to an incomplete internal security schema. This schema fails to properly classify certain URL-holding attributes as requiring strict URL security contexts. Specifically, attributes that can contain `javascript:` URLs, such as `xlink:href` in SVG or `math|href` in MathML, are not sanitized correctly. When template binding assigns user-controlled, untrusted data to these attributes, the compiler incorrectly falls back to a non-sanitizing context. Additionally, SVG animation elements like `` have an `attributeName` attribute that was not validated. Attackers can bind `attributeName` to “href” or “xlink:href” and provide a `javascript:` URL in the `values` or `to` attribute. This dynamic targeting bypasses Angular’s built-in sanitization. The malicious payload is injected into the application template. Upon user interaction, such as clicking the element, or automatically via animations, the `javascript:` URL executes arbitrary code in the application’s origin. This allows attackers to perform actions like session hijacking or data exfiltration. The vulnerability is stored because the malicious script is persisted through data binding from untrusted sources like databases or APIs. The attack preconditions include rendering user-derived data bound to vulnerable attributes and user interaction or animation triggers. Workarounds involve avoiding affected template bindings and implementing Content Security Policy.
Platform: Angular Template Compiler
Version: Not specified
Vulnerability: Stored XSS
Severity: Critical
date: Not specified

Prediction: Patch date unknown

What Undercode Say:

Analytics

Check Angular version for vulnerability assessment
ng version
Example of vulnerable template binding code
[attr.xlink:href]="userControlledURL"
<animate [bash]="'href'" [bash]="userControlledURL">

How Exploit:

Attackers inject malicious `javascript:` URLs via user-controlled data bound to vulnerable SVG/MathML attributes or SVG animation attributeName. The payload executes upon user interaction or animation trigger.

Protection from this CVE

Upgrade Angular immediately. Avoid binding untrusted data to vulnerable attributes. Implement strict Content Security Policy.

Impact:

Session hijacking, data exfiltration, unauthorized user actions.

🎯Let’s Practice Exploiting & Learn Patching For Free:

Sources:

Reported By: github.com
Extra Source Hub:
Undercode

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow DailyCVE & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin Featured Image

Scroll to Top