Junglewise Threat Intelligence

CVE-2023-26117: Google AngularJS ReDoS in $resource service

CVE-2023-26117 · Severity: low · CVSS 3.1 · Published 2023-03-30

Technologies: angular (npm). Vendors: Google, npm.

Executive brief

AngularJS, a popular framework for building web applications, is vulnerable to a denial-of-service attack. By providing specially crafted, large inputs to the $resource service, an attacker can cause the application to consume excessive processing power. This can lead to the application becoming slow or completely unresponsive for legitimate users.

Technical details

AngularJS versions 1.0.0 through 1.8.3 are vulnerable to Regular Expression Denial of Service (ReDoS) within the $resource service. The vulnerability is caused by an inefficient regular expression that is susceptible to catastrophic backtracking when processing specifically crafted, large input strings. An unauthenticated remote attacker can exploit this by sending malicious input to an application endpoint that utilizes the $resource service, leading to CPU exhaustion and a denial-of-service condition. The AngularJS project is archived and no longer receiving official updates, though some distributions like Debian and Fedora have provided backported fixes.

Affected products

  • Google angular from 1.0.0 up to and including 1.8.3

Timeline

  • 2023-03-30: advisory: Initial publication of the GHSA advisory.
  • 2024-04-12: other: AngularJS repository archived by owner.
  • 2025-07-20: patched: Debian LTS released a security update for angular.js.

References

Related threats