PT-2020-18315 · Angular · Angular-Expressions

Maxime Nadeau · Published 2020-01-24 · Updated 2020-01-31 · CVE-2020-5219

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Angular Expressions versions prior to 1.0.1

Description The issue allows for remote code execution if expressions.compile(userControlledInput) is called where userControlledInput is text from user input. In a browser environment, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput). On a server, an attacker could run any Javascript expression, thus gaining remote code execution.

Recommendations For versions prior to 1.0.1, upgrade to version 1.0.1 of angular-expressions. As a temporary workaround, consider disabling user-controlled input that will be fed into angular-expressions in your application. Alternatively, restrict userControlledInput to only allow specific characters by using a regular expression filter, such as if (/^[|a-zA-Z.0-9 :"+'-?]+$/.test(userControlledInput)).

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2020-5219

GHSA-HXHM-96PP-2M43

Affected Products

Angular-Expressions

References · 6

• https://github.com/peerigon/angular-expressions/commit/061addfb9a9e932a970e5fcb913d020038e65667 · Patch
• https://osv.dev/vulnerability/GHSA-hxhm-96pp-2m43 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5219 · Security Note
• http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5219 · Vendor Advisory
• https://github.com/peerigon/angular-expressions/security/advisories/GHSA-hxhm-96pp-2m43 · Note