CVE-2023-26117

Vulnerability

CVE-2023-26117 is a Regular Expression Denial of Service (ReDoS) vulnerability in the AngularJS $resource service, affecting all versions from 1.0.0 [1]. The root cause is the use of an insecure regular expression for URL parsing, which can cause catastrophic backtracking when processing a specially crafted input [3].

Exploitation

An attacker can exploit this vulnerability by submitting a large, carefully-crafted string to an application that uses AngularJS's $resource service [1]. No authentication is required if the service is exposed to user input; the attacker only needs to provide the malicious input via a parameter processed by $resource [3].

Impact

Successful exploitation results in a ReDoS condition, making the application unresponsive or crashing it, thus denying service to legitimate users [1]. The attacker does not gain access to data but can effectively disable the service.

Mitigation

AngularJS has ended official support as of January 2022, and no patch will be released [2]. Users should migrate to the actively supported Angular (version 2+) or apply workarounds such as input sanitization and validation [2][4].