Content Spoofing Vulnerability in AngularJS: Improper Sanitization of 'srcset' Attribute
Summary
DEBIAN-CVE-2024-8372: Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/att... Affects angular.js versions < 1.8.3-1+deb12u1~deb11u1. Fixed in 1.8.3-1+deb12u1~deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AngularJS is a widely-used JavaScript framework designed for building dynamic web applications. It allows developers to create single-page applications with a rich user experience. However, AngularJS has reached its End-of-Life status, meaning it will no longer receive updates or security patches. This vulnerability affects versions 1.3.0-rc.4 and greater, exposing applications to potential security risks.
Vulnerability Detail
The vulnerability arises from improper sanitization of the 'srcset' attribute in AngularJS, which allows attackers to bypass common image source restrictions. This can lead to content spoofing, where malicious content is displayed instead of intended images, potentially misleading users. The issue is significant as it can compromise the integrity of web applications, especially those relying on AngularJS for rendering dynamic content.
How To Fix
Minimum fixed version
1.8.3-1+deb12u1~deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade angular.jsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing strict content security policies (CSP) to limit the sources from which images can be loaded. This may help mitigate the risk of content spoofing until a proper update can be applied.
Conclusion
The improper sanitization of the 'srcset' attribute in AngularJS poses a significant security risk, allowing for content spoofing. It is crucial for users of affected versions to update to the patched versions provided for their respective Debian systems to mitigate this vulnerability.
See every vulnerability recorded for angular.js →
FAQ
The vulnerability is related to improper sanitization of the 'srcset' attribute in AngularJS, allowing for content spoofing.
AngularJS versions 1.3.0-rc.4 and greater are affected by this vulnerability.
Yes, patched versions are available for Debian systems. Users should update to the specified fixed versions.
Attackers can exploit this vulnerability to display misleading content, potentially harming users and compromising application integrity.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
References
Related vulnerabilities
Recent vulnerabilities recorded for angular.js.
