Executive brief
Angular Expressions is a JavaScript library that safely evaluates Angular-like expressions in a sandbox. A vulnerability allows attackers to bypass this sandbox protection when the library is used with a "locals" parameter, enabling arbitrary code execution on the system. This affects any application that uses angular-expressions version 1.4.2 or earlier and passes untrusted expressions with local variables.
Technical details
The vulnerability is a sandbox escape (CWE-94) in the angular-expressions library that occurs when expressions are compiled with the locals parameter (two-argument function call). An attacker can craft a malicious expression such as `__proto__.constructor` that accesses the prototype chain, which should return undefined but instead returns an object in vulnerable versions. This allows escape from the expression sandbox and leads to arbitrary code execution. The root cause is insufficient filtering of prototype chain access when locals are provided. The attack is unauthenticated and requires only the ability to pass an expression string to the compile() function with locals enabled. The vulnerability was patched in version 1.4.3 by explicitly disallowing prototype chain access in two-argument function calls.
Affected products
- peerigon angular-expressions <=1.4.2
Timeline
- 2024-12-10: disclosed
- 2024-12-10: patched: Version 1.4.3 released with fix