Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, with a CVSS score of 6.1, published 27 June 2019.

Which products and versions are affected?

angular (npm) SEMVER:introduced=0,fixed=1.6.0.

Is there a fix for This vulnerability?

Yes. angular (npm): upgrade to 1.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run AngularJS or angular (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

AngularJS Cross-Site Scripting via JSONP in $http service

Severity: info · CVSS 6.1 · Published 2019-06-27

AngularJS is a popular framework used to build web applications. In versions prior to 1.6.0, the framework allowed JSONP requests to be made to any URL without validation. This could allow a malicious actor to trick an application into executing unauthorized scripts, potentially leading to the theft of user session data or unauthorized actions on behalf of a user.

Technologies: AngularJS, angular (npm). Vendors: Angular, npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, with a CVSS score of 6.1, published 27 June 2019.
Which products and versions are affected?: angular (npm) SEMVER:introduced=0,fixed=1.6.0.
Is there a fix for This vulnerability?: Yes. angular (npm): upgrade to 1.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run AngularJS or angular (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

angular (npm): upgrade to 1.6.0 or later
```
npm install angular@1.6.0
```

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in AngularJS versions prior to 1.6.0 due to the $http service's handling of JSONP requests. The service did not enforce strict validation on the resource URLs used for JSONP, allowing the execution of scripts from untrusted origins. An attacker could exploit this by providing a malicious URL that, when processed by the application, executes arbitrary JavaScript in the context of the user's browser. The fix, introduced in version 1.6.0, requires JSONP URLs to be explicitly trusted via the $sce service or defined in a resource URL whitelist.

Affected products

Angular angular.js < 1.6.0

Timeline

2016-10-05: patched: Fix committed in angular.js repository.
2019-06-27: disclosed: Advisory published on GitHub.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.