Executive brief
AngularJS, a JavaScript framework used to build dynamic web applications, improperly sanitizes the srcset attribute in HTML image elements. This allows attackers to bypass content security restrictions that prevent unauthorized image loading, potentially leading to content spoofing attacks where users are shown misleading images or content that appears to come from a trusted source.
Technical details
The vulnerability is a content spoofing issue (CWE-791) resulting from improper sanitization of the srcset attribute in <source> HTML elements within AngularJS. The framework fails to properly validate or escape srcset values, allowing attackers to craft malicious HTML that bypasses common Content Security Policy (CSP) restrictions on image sources. The attack requires no authentication or user interaction and is network-reachable. An attacker can inject arbitrary image sources or URLs, leading to unauthorized image loading and potential content spoofing attacks. This vulnerability affects all versions of AngularJS up to and including 1.8.3; however, AngularJS is end-of-life and will not receive patches.
Affected products
- Google AngularJS All versions up to and including 1.8.3
Timeline
- 2024-09-09: disclosed: Published as GHSA-mqm9-c95h-x2p6 / CVE-2024-8373
- 2024-09-09: other: NVD published