Denial of Service Vulnerability in Angular.js - CVE-2024-21490
Summary
UBUNTU-CVE-2024-21490: This affects versions of the package angular from 1.3.0. Affects angular.js versions 1.5.10-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Angular.js is a widely used JavaScript framework for building dynamic web applications. It provides a robust structure for developing single-page applications and is known for its two-way data binding, dependency injection, and modular architecture. However, certain versions of Angular.js are vulnerable to a denial of service attack due to a flaw in the ng-srcset directive's regular expression handling.
Vulnerability Detail
The vulnerability identified as CVE-2024-21490 affects Angular.js versions starting from 1.3.0. It arises from a regular expression used to split the value of the ng-srcset directive, which is susceptible to super-linear runtime due to backtracking. When large, specially crafted input is processed, it can lead to catastrophic backtracking, resulting in a denial of service. This vulnerability can severely impact application performance and availability, making it critical for users to address it promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, if immediate migration is not feasible, users can implement input validation to limit the size and complexity of the input being processed by the ng-srcset directive, thereby reducing the risk of triggering the vulnerability.
Conclusion
CVE-2024-21490 is a significant vulnerability in Angular.js that can lead to denial of service. Users are strongly encouraged to migrate to @angular/core to mitigate this risk. Immediate action is necessary to ensure the security and performance of applications using affected versions of Angular.js.
See every vulnerability recorded for angular.js →
FAQ
CVE-2024-21490 is a vulnerability in Angular.js that can lead to denial of service due to a flaw in the ng-srcset directive's regular expression handling.
All versions of Angular.js starting from 1.3.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, implement input validation to limit the size and complexity of inputs processed by the ng-srcset directive.
The CVSS score for CVE-2024-21490 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for angular.js.
