CVE-2024-21490
📋 TL;DR
This CVE describes a regular expression denial of service (ReDoS) vulnerability in AngularJS versions 1.3.0 and above. Attackers can cause denial of service by providing specially crafted input to the ng-srcset directive that triggers catastrophic backtracking. This affects all applications using vulnerable AngularJS versions, particularly those accepting user-controlled input in ng-srcset attributes.
💻 Affected Systems
- AngularJS
📦 What is this software?
Angular.js by Angularjs
⚠️ Risk & Real-World Impact
Worst Case
Complete application unavailability due to CPU exhaustion from ReDoS, potentially affecting all users of the vulnerable application.
Likely Case
Degraded performance or temporary unavailability for users accessing pages with malicious ng-srcset payloads.
If Mitigated
Minimal impact if input validation prevents malicious payloads or if application load is distributed across multiple instances.
🎯 Exploit Status
Proof-of-concept available at provided StackBlitz link. Exploitation requires ability to control ng-srcset attribute content.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
Migrate to @angular/core as AngularJS is end-of-life. No official patch exists for AngularJS.
🔧 Temporary Workarounds
Input Validation for ng-srcset
allImplement strict input validation/sanitization for any user-controlled data used in ng-srcset attributes to prevent malicious payloads.
Rate Limiting
allImplement rate limiting and request throttling to mitigate impact of denial of service attempts.
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to detect and block ReDoS patterns in ng-srcset input
- Monitor CPU usage and implement automatic scaling/restart mechanisms for application instances under attack
🔍 How to Verify
Check if Vulnerable:
Check package.json or bower.json for angular dependency version 1.3.0 or higherCheck Version:
npm list angular or check bower_components/angular/package.jsonVerify Fix Applied:
Verify migration to @angular/core or implementation of input validation workarounds📡 Detection & Monitoring
Log Indicators:
- Unusually high CPU usage
- Request timeouts on pages with ng-srcset
- Repeated requests with similar ng-srcset patterns
Network Indicators:
- High volume of requests to pages containing ng-srcset attributes
- Requests with unusually long ng-srcset parameter values
SIEM Query:
source=application_logs AND ("ng-srcset" OR "angular") AND (cpu_usage>90 OR response_time>5000)🔗 References
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6241746
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6241747
- https://security.snyk.io/vuln/SNYK-JS-ANGULAR-6091113
- https://stackblitz.com/edit/angularjs-vulnerability-ng-srcset-redos
- https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6241746
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6241747
- https://security.snyk.io/vuln/SNYK-JS-ANGULAR-6091113
- https://stackblitz.com/edit/angularjs-vulnerability-ng-srcset-redos
- https://support.herodevs.com/hc/en-us/articles/25715686953485-CVE-2024-21490-AngularJS-Regular-Expression-Denial-of-Service-ReDoS
