Content Spoofing Vulnerability in AngularJS Due to Improper srcset Attribute Sanitization
Summary
CVE-2024-8373: Improper sanitization of the value of the [srcset] attribute in HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/... Affects angular.js across 2 version ranges.
< 1.8.3-1+deb12u1~deb11u1
< cf16b241e1c61c22a820ed8211bc2332ede88e62
Fixed in 1.8.3-1+deb12u1~deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AngularJS is a widely-used open-source web application framework maintained by Google, designed to facilitate the development of dynamic web applications. It allows developers to use HTML as their template language and extend HTML's syntax to express application components clearly. However, AngularJS has reached its End-of-Life status, meaning it no longer receives updates or security patches, making it susceptible to vulnerabilities such as CVE-2024-8373.
Vulnerability Detail
CVE-2024-8373 arises from improper sanitization of the 'srcset' attribute in <source> HTML elements within AngularJS. This flaw allows attackers to bypass standard image source restrictions, potentially leading to content spoofing attacks where malicious content can be displayed to users. The vulnerability affects all versions of AngularJS, and due to the framework's End-of-Life status, no official fixes will be provided.
How To Fix
Minimum fixed version
1.8.3-1+deb12u1~deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade angular.jsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While there is no direct workaround for this vulnerability due to the lack of updates, developers can implement additional input validation and sanitization on their own to limit the risk of content spoofing. For example, ensure that any user-generated content is thoroughly checked before being rendered in the application.
Conclusion
CVE-2024-8373 represents a significant security risk for applications using AngularJS due to its improper handling of the 'srcset' attribute. With AngularJS no longer receiving updates, developers are urged to migrate to supported frameworks and implement additional security measures to protect their applications.
See every vulnerability recorded for angular.js →
FAQ
CVE-2024-8373 is a vulnerability in AngularJS that allows attackers to bypass image source restrictions due to improper sanitization of the 'srcset' attribute in <source> HTML elements.
All versions of AngularJS are affected by this vulnerability.
The main consequence is content spoofing, where attackers can display malicious content to users, potentially leading to phishing or other security issues.
No, there is no fix available as AngularJS has reached its End-of-Life status and will not receive any updates.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing your manifest file. Visit Vulert Scanner to check your application without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for angular.js.
