Remote Code Execution in Angular Expressions

CVE-2020-5219 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

Impact

The vulnerability, reported by GoSecure Inc, allows Remote Code Execution, if you call expressions.compile(userControlledInput) where userControlledInput is text that comes from user input.

  • If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput).
  • If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution.

Patches

Users should upgrade to version 1.0.1 of angular-expressions

Workarounds

A temporary workaround might be either to :

  • disable user-controlled input that will be fed into angular-expressions in your application

OR

  • allow only following characters in the userControlledInput : 
if (/^[|a-zA-Z.0-9 :"'+-?]+$/.test(userControlledInput)) {
      var result = expressions.compile(userControlledInput);
}
else {
     result = undefined;
}

References

Removal of angular-expression sandbox

For more information

If you have any questions or comments about this advisory:
* Open an issue in angular-expressions
* Email us

Credits

The issue was reported by Maxime Nadeau from GoSecure, Inc.

Basic information

Type
reviewed
Severity
high
Advisory on GitHub
Open advisory ↗
Repository advisory
Open repository advisory ↗
Source code
Not specified
Published (advisory)
2020-01-24 15:27:25 UTC
Updated
2023-01-09 05:01:58 UTC
GitHub reviewed
2020-01-24 15:27:04 UTC

EPSS Score

Score Percentile
0.63% 69.57%

CVSS Scores

Base score Version Severity Vector
8.7 3.1 —
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:R)
A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:C)
Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:N)
Service keeps running; no real outage angle.

Identifiers

Type Value
GHSA GHSA-hxhm-96pp-2m43 ↗
CVE CVE-2020-5219 ↗

CWEs

CWE id Name
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Credits

  • MaxNad (analyst)

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
npm angular-expressions < 1.0.1 1.0.1 —

References

cvelogic Threat Intelligence