Executive brief
Angular Expressions is a JavaScript library used to safely evaluate user-provided expressions in web and server applications. The vulnerability allows attackers to bypass the expression sandbox and execute arbitrary code by crafting malicious input passed to the compile() function. An attacker can achieve remote code execution on affected servers or run arbitrary scripts in affected browsers.
Technical details
The vulnerability is a code injection flaw (CWE-74/CWE-94) in angular-expressions that allows Remote Code Execution when user-controlled input is passed to the expressions.compile() function. The sandbox escape uses a .constructor.constructor technique to bypass the expression filter. Attack requires network access and application code that directly compiles user input without sanitization; no authentication is required if the vulnerable code path is exposed. An attacker can execute arbitrary JavaScript code in the browser context or on the server depending on deployment. The fix is available in version 1.1.2 and later.
Affected products
- peerigon angular-expressions before 1.1.2
Timeline
- 2021-02-01: disclosed
- 2021-02-01: patched: version 1.1.2