Executive brief
AngularJS is a popular framework used to build web applications. In versions prior to 1.6.0, the framework allowed JSONP requests to be made to any URL without validation. This could allow a malicious actor to trick an application into executing unauthorized scripts, potentially leading to the theft of user session data or unauthorized actions on behalf of a user.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in AngularJS versions prior to 1.6.0 due to the $http service's handling of JSONP requests. The service did not enforce strict validation on the resource URLs used for JSONP, allowing the execution of scripts from untrusted origins. An attacker could exploit this by providing a malicious URL that, when processed by the application, executes arbitrary JavaScript in the context of the user's browser. The fix, introduced in version 1.6.0, requires JSONP URLs to be explicitly trusted via the $sce service or defined in a resource URL whitelist.
Affected products
- Angular angular.js < 1.6.0
Timeline
- 2016-10-05: patched: Fix committed in angular.js repository.
- 2019-06-27: disclosed: Advisory published on GitHub.