CVE-2024-21490: AngularJS regular expression denial of service in ng-srcset

CVE-2024-21490 · Severity: low · CVSS 3.1 · Published 2024-02-10

AngularJS is a widely-used JavaScript framework for building dynamic web applications. A vulnerability exists in how the framework parses image source attributes (ng-srcset directive) that can be exploited by sending specially-crafted input. An attacker can cause the application to consume excessive CPU resources and become unresponsive, denying service to legitimate users. Since AngularJS is no longer maintained, users must migrate to the modern @angular/core framework for a fix.

Technologies: angular (npm). Vendors: Maven, npm.

Quick answers

Is CVE-2024-21490 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-21490 being exploited in the wild.
How severe is CVE-2024-21490?
Low severity, with a CVSS score of 3.1, published 10 February 2024.
Which products and versions are affected?
org.webjars.bower:angular (Maven) ECOSYSTEM:introduced=1.3.0,last_affected=1.8.3; org.webjars.npm:angular (Maven) ECOSYSTEM:introduced=1.3.0,last_affected=1.8.3; angular (npm) SEMVER:introduced=1.3.0,last_affected=1.8.3.
Is there a fix for CVE-2024-21490?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-21490 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-21490?
Check whether you run org.webjars.bower:angular (Maven), org.webjars.npm:angular (Maven) or angular (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a Regular Expression Denial of Service (ReDoS) flaw in the regular expression used to split the ng-srcset directive value in AngularJS (CWE-1333). The vulnerable regex exhibits catastrophic backtracking behavior when processing specially-crafted input strings with repetitive patterns. An attacker can remotely trigger this vulnerability by injecting a malicious ng-srcset attribute value in a web page served by an AngularJS application; no authentication or user interaction is required. The attack causes the regex engine to perform an exponential number of backtracking operations, exhausting CPU resources and rendering the application unresponsive. The affected versions span from 1.3.0 to 1.8.3. Since AngularJS is end-of-life, no patches will be released; users must migrate to @angular/core.

Affected products

  • Angular AngularJS 1.3.0 to 1.8.3
  • npm angular 1.3.0 to 1.8.3
  • Webjars org.webjars.npm:angular 1.3.0 to 1.8.3
  • Webjars org.webjars.bower:angular 1.3.0 to 1.8.3

Identifiers

  • CVE-2024-21490
  • GHSA-4w4v-5hc9-xrr2

Timeline

  • 2023-11-28: disclosed: Vulnerability reported to Snyk
  • 2024-02-10: advisory: GHSA-4w4v-5hc9-xrr2 and CVE-2024-21490 published
  • 2024-04-12: other: AngularJS repository archived; package marked end-of-life

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.