Executive brief
Angular SSR (Server-Side Rendering) is a framework component that renders web pages on the server before sending them to clients. A flaw in its URL handling allows attackers to forge requests to arbitrary external servers by crafting malicious URLs starting with double slashes, causing the server to fetch data from attacker-controlled domains instead of legitimate sources. This can lead to unauthorized data access, server-side request interception, and potential lateral movement within network infrastructure.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in the createRequestUrl function of @angular/ssr's URL resolution mechanism. The function uses the native JavaScript URL constructor with an attacker-controlled path; when the path begins with "//" or "\\", the URL constructor interprets it as schema-relative, overriding the intended base URL (protocol, host, port) and instead resolving relative to an attacker-specified hostname. This allows an attacker to inject external domains via requests like "http://localhost:4200//attacker-domain.com/some-page", causing subsequent relative requests (e.g., "api/data") to resolve to "http://attacker-domain.com/api/data". The vulnerability affects @angular/ssr versions 19.0.0-next.0 through 19.2.17, 20.0.0-next.0 through 20.3.5, and 21.0.0-next.0 through 21.0.0-next.7. Patches are available in versions 19.2.18, 20.3.6, and 21.0.0-next.8. Workaround: sanitize incoming request paths to remove leading double slashes via server-side middleware.
Affected products
- Google @angular/ssr >=19.0.0-next.0 <19.2.18, >=20.0.0-next.0 <20.3.6, >=21.0.0-next.0 <21.0.0-next.8
Timeline
- 2025-10-16: disclosed