Executive brief
Angular is a JavaScript framework used to build interactive web applications. Versions before 1.7.9 contain a flaw in the deprecated merge() function that allows an attacker to inject malicious properties into the core Object prototype, potentially affecting all objects in an application and leading to data manipulation or application logic bypass.
Technical details
The vulnerability is a prototype pollution flaw in the angular.merge() function (CWE-1321, CWE-20, CWE-915). The deprecated merge() API does not properly restrict modification of an Object's __proto__ property during deep merging operations, allowing an attacker to pollute the Object prototype with arbitrary properties. This is a network-reachable vulnerability requiring no authentication or user interaction; an attacker can craft malicious input containing __proto__ keys to inject properties that persist across all objects. The fix (version 1.7.9) explicitly blocks __proto__ from being merged, and this was already deprecated code so upgrades should not break existing functionality.
Affected products
- Google Angular before 1.7.9
Timeline
- 2019-11-20: disclosed: Advisory published
- 2019-11-07: patched: Fix merged in PR #16913