Denial of Service Vulnerability in Angular.js Due to Regular Expression Backtracking
Summary
CVE-2024-21490: This affects versions of the package angular from 1.3.0. Affects angular.js versions < 1.8.3-1+deb12u1~deb11u1. Fixed in 1.8.3-1+deb12u1~deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Angular.js is a widely-used JavaScript framework that simplifies the development of dynamic web applications. It provides features such as two-way data binding, dependency injection, and modularization, making it a popular choice among developers. However, the package has reached its end-of-life (EOL), meaning it will no longer receive updates or security patches, leaving it vulnerable to various security issues, including the one described here.
Vulnerability Detail
The vulnerability arises from a regular expression used in the ng-srcset directive, which is susceptible to super-linear runtime performance issues due to catastrophic backtracking. When large, specially crafted input is processed, it can lead to significant delays or crashes, resulting in a denial of service (DoS). This vulnerability affects all versions of Angular.js starting from 1.3.0 and poses a serious risk to applications still using this outdated framework.
How To Fix
Minimum fixed version
1.8.3-1+deb12u1~deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade angular.jsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As Angular.js is no longer maintained, there are no official workarounds to fix this vulnerability. The best approach is to migrate to a supported framework. If immediate migration is not feasible, consider sanitizing inputs to avoid triggering the vulnerable regular expression, though this is not a foolproof solution.
Conclusion
The CVE-2024-21490 vulnerability in Angular.js poses a significant risk due to its potential to cause denial of service through regular expression backtracking. Given that Angular.js is no longer maintained, the recommended course of action is to migrate to a supported framework. Users should take immediate steps to assess their applications and implement necessary updates to ensure security.
See every vulnerability recorded for angular.js →
FAQ
CVE-2024-21490 is a vulnerability in Angular.js that allows for denial of service due to a vulnerable regular expression in the ng-srcset directive.
All versions of Angular.js starting from 1.3.0 are affected by this vulnerability.
The vulnerability can lead to catastrophic backtracking, causing significant performance degradation or crashes, resulting in denial of service for users.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to install any software.
While there are no official workarounds, you may attempt to sanitize inputs to prevent triggering the vulnerable regex, but this is not a guaranteed solution.
Related vulnerabilities
Recent vulnerabilities recorded for angular.js.
