Critical Prototype Pollution Vulnerability in AngularJS - CVE-2019-10768
Summary
CVE-2019-10768: In AngularJS before 1.7.9 the function merge() could be tricked into adding or modifying properties of Object.prototype using a proto payload. Affects angular.js across 2 version ranges.
< 1.7.9-1
< d257c4564d069a279c5625ad6b68008d4a4dbb11
Fixed in 1.7.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
AngularJS is a widely-used open-source web application framework maintained by Google. It allows developers to create dynamic single-page applications with a structured approach. The framework provides features such as two-way data binding, dependency injection, and modular development, making it a popular choice for building rich web applications. However, prior to version 1.7.9, AngularJS was susceptible to a prototype pollution vulnerability that could compromise application security.
Vulnerability Detail
CVE-2019-10768 is a vulnerability in AngularJS versions before 1.7.9, where the merge() function could be exploited to manipulate properties of Object.prototype using a specially crafted __proto__ payload. This could lead to unauthorized modification of object properties, potentially allowing attackers to execute arbitrary code or alter application behavior. The vulnerability arises from improper handling of object merging, which can be exploited in various scenarios, particularly in applications that rely on user input to merge objects.
How To Fix
Minimum fixed version
1.7.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade angular.jsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider implementing input validation to sanitize user inputs before they are processed by the merge() function. This can help mitigate the risk of prototype pollution. For example, you can check for the presence of __proto__ in user inputs and reject any requests that attempt to manipulate object prototypes.
Conclusion
CVE-2019-10768 represents a significant security risk for applications using AngularJS versions prior to 1.7.9. It is crucial for developers to upgrade to the latest version to protect their applications from potential exploitation. Additionally, utilizing tools like Vulert can help in monitoring and alerting for such vulnerabilities in real-time.
See every vulnerability recorded for angular.js →
FAQ
CVE-2019-10768 is a security vulnerability in AngularJS that allows attackers to manipulate object properties through prototype pollution.
You can check if your application is affected by using tools like Vulert, which monitors open-source vulnerabilities based on your manifest file.
Exploitation of this vulnerability can lead to unauthorized code execution, data manipulation, and potential compromise of application integrity.
Yes, implementing input validation to sanitize user inputs can help mitigate the risk until an upgrade can be performed.
The CVSS score for CVE-2019-10768 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for angular.js.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
