Junglewise Threat Intelligence

CVE-2025-66035: Angular HttpClient XSRF token leakage via protocol-relative URLs

CVE-2025-66035 · Severity: high · CVSS 4 · Published 2025-11-26

Technologies: Google Angular Common. Vendors: Google.

Executive brief

Angular is a popular JavaScript framework used to build interactive web applications. Angular includes built-in protection against Cross-Site Request Forgery (CSRF) attacks by automatically managing security tokens. A flaw in this protection causes the framework to leak these tokens when applications send requests to protocol-relative URLs (URLs starting with //). An attacker can exploit this by tricking an application into sending a request to an attacker-controlled domain, capturing the security token, and then using it to perform unauthorized actions in the user's account.

Technical details

The vulnerability is a credential leak in Angular's HttpClient XSRF interceptor. The interceptor determines whether a request is cross-origin by checking if the URL starts with a protocol (`http://` or `https://`). However, protocol-relative URLs starting with `//` are incorrectly classified as same-origin requests, causing the XSRF token to be included in the `X-XSRF-TOKEN` header. An attacker can trigger a state-changing request (e.g., POST) to a protocol-relative URL pointing to an attacker-controlled domain to capture the token. The vulnerability affects Angular versions prior to 19.2.16, 20.3.14, and 21.0.1. Patches correct the interceptor logic to properly identify protocol-relative URLs as absolute URLs and exclude them from XSRF token injection. The attack requires XSRF protection to be enabled and the ability to trigger the application to make an HTTP request to an attacker-controlled URL.

Affected products

  • Google @angular/common <19.2.16, >=20.0.0-next.0, <20.3.14, >=21.0.0-next.0, <21.0.1

Timeline

  • 2025-11-26: disclosed
  • 2025-11-26: patched: Patches released: 19.2.16, 20.3.14, 21.0.1

References

Related threats