PT-2023-4756 · Google+1 · Angular+1

George Kalpakas + 1 · Published 2023-03-30 · Updated 2026-01-14 · CVE-2023-26118

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions angular versions 1.4.9 and later

Description The issue is related to the usage of an insecure regular expression in the input[url] functionality of the angular package, which can lead to a Regular Expression Denial of Service (ReDoS) via the element. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking. This can allow a remote attacker to cause a denial of service.

Recommendations For angular versions 1.4.9 and later, consider disabling the input[url] functionality until a patch is available. Restrict access to the element to minimize the risk of exploitation. Avoid using the input[url] functionality with large or untrusted inputs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

BDU:2023-05196

CVE-2023-26118

DLA-4242-1

GHSA-QWQH-HM9M-P5HR

USN-7958-1

Affected Products

Debian

Angular

References · 34

• 🔥 https://stackblitz.com/edit/angularjs-vulnerability-inpur-url-validation-redos · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-5406327 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373046 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406328 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-5406326 · Exploit
• https://osv.dev/vulnerability/GHSA-qwqh-hm9m-p5hr · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-26117 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14863 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-25844 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-26118 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/OQWJLE5WE33WNMA54XSJIDXBRK2KL3XJ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UDKFLKJ6VZKL52AFVW2OVZRMJWHMW55K · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7958-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-26116 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26118 · Vendor Advisory