CVE-2023-26116

Vulnerability

The angular.copy() utility function in AngularJS versions 1.2.21 and later contains an insecure regular expression that is susceptible to catastrophic backtracking [4]. This Regular Expression Denial of Service (ReDoS) vulnerability allows an attacker to cause excessive CPU consumption by providing a large, carefully crafted input to the function.

Exploitation

Exploitation is possible by passing a specially crafted string to angular.copy() in any context where user input is accepted. Since the vulnerability lies in a core utility, it can be triggered both in client-side browsers and in server-side Node.js environments using the angular package. No authentication is required if the function is exposed to untrusted data [4].

Impact

Successful exploitation leads to denial of service, causing the application to hang or become unresponsive. This can disrupt service availability for legitimate users. AngularJS support officially ended in January 2022 [2], and no patch for this vulnerability has been released. Users are strongly advised to migrate to actively supported frameworks such as Angular (2+).

Mitigation

As AngularJS is end-of-life, the only effective mitigation is to upgrade to a supported framework. Debian LTS may provide backported fixes [1], but the vendor recommends migrating away from AngularJS [2].