Executive brief
AngularJS is a popular JavaScript framework used to build dynamic web applications. The framework failed to properly sanitize SVG xlink:href attributes, allowing attackers to inject and execute malicious JavaScript code in users' browsers if they interact with a page containing user-controlled SVG attributes. This could lead to account compromise, credential theft, or redirection to malicious sites.
Technical details
This is a cross-site scripting (XSS) vulnerability (CWE-79) in AngularJS's HTML sanitization routines. The framework's sanitizer failed to properly validate and escape xlink:href attributes in SVG elements, a common vector for injecting JavaScript protocol handlers. The vulnerability requires user interaction (victim must click or interact with the malicious SVG element) and the xlink:href value must be user-controlled or attacker-influenced. An attacker can craft a malicious SVG document that, when rendered by a vulnerable AngularJS application, executes arbitrary JavaScript with the privileges of the authenticated user. The fix is available in AngularJS version 1.5.0-beta.1 and later.
Affected products
- AngularJS AngularJS prior to 1.5.0-beta.1
Timeline
- 2020-02-14: disclosed
- 2015-08-07: patched: Fix merged in PR #12524