CVE-2024-21490: Angular - Super-linear Runtime Due to Backtracking
Summary
CVE-2024-21490: angular vulnerable to super-linear runtime due to backtracking. Affects angular versions >= 1.3.0, <= 1.8.3. No fix is published. How to fix ↓
Also tracked for
- angular.js · Debian:11
The same CVE-2024-21490 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Angular is an open-source JavaScript framework developed by Google. It is widely used for building web applications and provides a comprehensive set of features for creating dynamic and responsive user interfaces. The ng-srcset directive in Angular allows developers to specify a list of image sources and sizes for different screen resolutions. However, versions of Angular from 1.3.0 are vulnerable to a super-linear runtime issue due to backtracking in the regular expression used to split the value of the ng-srcset directive. This vulnerability can be exploited by providing a large, carefully-crafted input, leading to catastrophic backtracking and causing a denial of service.
Vulnerability Detail
The vulnerability in Angular arises from a regular expression used to split the value of the ng-srcset directive. When a large input is provided, the regular expression can exhibit super-linear runtime due to backtracking. This can result in a denial of service as the application becomes unresponsive or crashes. The impact of this vulnerability can be severe, especially in production environments where the application is exposed to untrusted user input. It is important to note that this vulnerability affects versions of Angular up to 1.8.3 and the package is no longer receiving updates to address this issue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As the affected package is no longer receiving updates, there is no official workaround provided. However, if migration to @angular/core is not feasible, one possible workaround is to manually modify the vulnerable code in the Angular package. This would involve identifying the regular expression used in the ng-srcset directive and replacing it with a secure implementation that does not exhibit super-linear runtime. It is crucial to exercise caution and thoroughly test the modified code to ensure it does not introduce any unintended side effects.
Conclusion
The vulnerability in Angular versions 1.3.0 to 1.8.3 can result in a denial of service due to super-linear runtime caused by backtracking in the regular expression used for ng-srcset. It is crucial to migrate to the @angular/core package to address this vulnerability. If migration is not possible, manual modification of the vulnerable code can be considered, but it should be done with caution and thoroughly tested. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for angular →
FAQ
The vulnerability can lead to a denial of service as the application becomes unresponsive or crashes when a large, carefully-crafted input is provided.
Versions of Angular from 1.3.0 up to 1.8.3 are affected by this vulnerability.
The recommended fix is to migrate to the https://www.npmjs.com/package/@angular/core package, which does not suffer from the super-linear runtime issue.
If migration is not feasible, a possible workaround is to manually modify the vulnerable code in the Angular package. However, this should be done with caution and thoroughly tested.
Yes, Angular has a large and active community of developers who provide support, resources, and updates for the framework.
Related vulnerabilities
Recent vulnerabilities recorded for angular.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
