Executive brief
angular-expressions is a JavaScript library that evaluates Angular-like expressions. A vulnerability in the expressions.compile() function allows attackers to execute arbitrary JavaScript code if the library processes user-controlled input without sanitization. In browser environments, this enables script execution in the user's browser; on servers, this results in remote code execution with the privileges of the Node.js process.
Technical details
The vulnerability is a code injection flaw (CWE-74) in the angular-expressions library's expression compiler. When user-controlled input is passed directly to the expressions.compile() function, the parser fails to properly sanitize or validate the input, allowing attackers to inject arbitrary JavaScript expressions. The attack requires the application code to call compile() on untrusted data; no authentication is required, but user interaction (or application-level input handling) is necessary. An attacker can achieve arbitrary code execution. The vulnerability affects all versions prior to 1.0.1; users should upgrade immediately.
Affected products
- Peerigon angular-expressions < 1.0.1
Timeline
- 2020-01-24: disclosed
- 2020-01-24: patched: Version 1.0.1 released with fix