PT-2026-49560 · Google · Angular
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Angular versions prior to 22.0.0-rc.2
Angular versions prior to 21.2.15
Angular versions prior to 20.3.22
Angular versions prior to 19.2.23
Description
An issue in the
@angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it uses an internal helper function to reconstruct a new Request object. This process strips client-defined request redirect policy configurations, such as redirect: 'error', and reverts to the browser's default 'follow' strategy. Consequently, if an application makes client-side requests with a strict policy, the service worker bypasses this instruction and automatically follows HTTP 3xx redirects. This creates a Confused Deputy scenario—where a privileged entity is tricked into performing an action on behalf of an unauthorized party—which can lead to cookie or credential exposure and the leakage of same-origin session-restricted data if public dynamic routes redirect to sensitive routes.Recommendations
Update to version 22.0.0-rc.2.
Update to version 21.2.15.
Update to version 20.3.22.
Update to version 19.2.23.
Refactor server architecture to ensure public paths matched by service worker asset groups do not issue HTTP 3xx redirects to authenticated same-origin secure endpoints.
Apply strict flags to session cookies (
SameSite=Strict; Secure; HttpOnly) and use explicit route isolations, such as subdomains, for credential-guarded private resources.
Modify ngsw-config.json to ensure patterns targeting dynamic, secure endpoints are explicitly excluded from automatic asset groups or caching scopes.Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Angular