Critical ReDoS Vulnerability in Angular.js Package
Summary
DEBIAN-CVE-2023-26117: Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular expression. Affects angular.js versions < 1.8.3-1+deb12u1~deb11u1. Fixed in 1.8.3-1+deb12u1~deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Angular.js is a widely-used JavaScript framework designed for building dynamic web applications. It provides a robust set of features for developing single-page applications, including data binding, dependency injection, and a modular architecture. However, certain versions of Angular.js are vulnerable to a Regular Expression Denial of Service (ReDoS) attack, which can severely impact application performance and availability.
Vulnerability Detail
Versions of the Angular.js package from 1.0.0 are susceptible to a Regular Expression Denial of Service (ReDoS) via the $resource service. This vulnerability arises from the use of an insecure regular expression that can lead to catastrophic backtracking when processing large, specially crafted inputs. Exploiting this vulnerability can cause significant delays in application response times, potentially leading to service outages.
How To Fix
Minimum fixed version
1.8.3-1+deb12u1~deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade angular.jsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to limit the size and complexity of inputs processed by the $resource service. This can help mitigate the risk of ReDoS attacks until the package is updated.
Conclusion
The vulnerability in Angular.js presents a serious risk due to its potential to cause Denial of Service attacks through the $resource service. It is crucial for developers to update to the latest patched versions to mitigate this risk and ensure application stability.
See every vulnerability recorded for angular.js →
FAQ
ReDoS is a type of denial-of-service attack that exploits the way regular expressions are processed. By providing a specially crafted input, an attacker can cause excessive backtracking, leading to significant delays in processing.
All versions of Angular.js from 1.0.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploiting this vulnerability can lead to significant performance degradation and potential service outages, affecting user experience and application reliability.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for angular.js.
