PT-2023-4755 · Google+1 · Angular+1
George Kalpakas
+1
·
Publicado
2023-03-30
·
Atualizado
2026-01-14
·
CVE-2023-26116
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
angular versions 1.2.21 and later
Description
The issue is related to the angular.copy() utility function, which uses an insecure regular expression. This can lead to a Regular Expression Denial of Service (ReDoS) via a large carefully-crafted input, resulting in catastrophic backtracking. Exploiting this issue is possible, allowing a remote attacker to cause a denial of service.
Recommendations
For versions 1.2.21 and later, consider disabling the
angular.copy() function until a patch is available to prevent potential exploitation. Restricting the input to the angular.copy() function can also help minimize the risk of catastrophic backtracking. As a temporary workaround, avoid using large inputs that could trigger the insecure regular expression. At the moment, there is no information about a newer version that contains a fix for this issue.Exploit
Correção
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Debian
Angular