Executive brief
AngularJS, a popular JavaScript framework used to build dynamic web applications, improperly sanitizes the srcset attribute in image tags. This allows attackers to bypass Content Security Policy (CSP) restrictions designed to prevent unauthorized image loading, potentially leading to data leakage or displaying malicious content to users. AngularJS is end-of-life and will not receive patches for this issue.
Technical details
This vulnerability is an improper input sanitization flaw (CWE-1289) affecting AngularJS versions 1.3.0-rc.4 through 1.8.3. The srcset attribute on image elements is not properly sanitized, allowing attackers to construct malicious values that bypass Content Security Policy image source directives. The attack is network-accessible but requires manipulation of attribute values, typically through reflected or stored XSS or user-controlled template injection. Exploitation can result in CSP bypass and content spoofing attacks. No patch is available as the AngularJS project reached end-of-life and will not address this issue.
Affected products
- Google AngularJS 1.3.0-rc.4 through 1.8.3
Timeline
- 2024-09-09: disclosed