AngularJS improper sanitization in '<source>' element

Vulnerability

Description

CVE-2024-8373 is an improper sanitization vulnerability in AngularJS that affects all versions of the framework. The bug lies in the handling of the [srcset] attribute on ` HTML elements. AngularJS normally applies image source sanitization to and elements to restrict which domains can be used for images, but this sanitization is bypassed when setting the srcset attribute via the ngAttrSrcset` directive or interpolation [1][2].

Attack

Vector and Prerequisites

An attacker can exploit this vulnerability by injecting a malicious URL into the srcset attribute of a `` element. This can be achieved through any mechanism that allows user-controlled input to be bound to the attribute, such as template injection or cross-site scripting (XSS) vectors. No authentication is required if the application renders user-supplied data in AngularJS templates. The attacker only needs to be able to provide content that the application processes as part of a template [2][3].

Impact

Successful exploitation allows an attacker to bypass restrictions on image sources, enabling them to load images from arbitrary external domains. This can be leveraged for content spoofing, where the attacker injects misleading content into a page displayed under the context of the trusted domain. This attack can be used for phishing, defacement, or other forms of UI manipulation [2][3].

Mitigation and

Status

The AngularJS project is End-of-Life (EOL) and will not receive official patches for this vulnerability [1][2]. However, third-party support providers (e.g., HeroDevs) have released patched versions such as AngularJS NES v1.9.6, v1.5.22, and v1.4.16. Users still running AngularJS should apply one of these secure versions or migrate to the actively supported Angular framework [1][3].