CVE-2024-8372
📋 TL;DR
This AngularJS vulnerability allows attackers to bypass image source restrictions via improper sanitization of the 'srcset' attribute, enabling content spoofing attacks. It affects AngularJS versions 1.3.0-rc.4 and greater, but AngularJS is end-of-life and won't receive official patches.
💻 Affected Systems
- AngularJS
📦 What is this software?
Angularjs by Angularjs
Angularjs by Angularjs
Angularjs by Angularjs
⚠️ Risk & Real-World Impact
Worst Case
Attackers could spoof legitimate content on websites, potentially tricking users into revealing sensitive information or performing unintended actions through convincing fake interfaces.
Likely Case
Content spoofing where attackers display misleading images or content that appears legitimate, potentially damaging brand reputation or enabling phishing-like attacks.
If Mitigated
With proper Content Security Policies and input validation, the impact is limited to visual deception without direct code execution or data theft.
🎯 Exploit Status
Public proof-of-concept demonstrates the bypass technique. Exploitation requires user interaction or content injection opportunities.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: https://docs.angularjs.org/misc/version-support-status
Restart Required: No
Instructions:
No official patch available due to AngularJS end-of-life status. Migrate to supported Angular versions or implement workarounds.
🔧 Temporary Workarounds
Implement custom sanitization
allAdd custom sanitization for srcset attributes to validate and sanitize image sources before rendering.
Implement custom AngularJS sanitizer that validates srcset URLs against allowlists
Content Security Policy (CSP)
allImplement strict Content Security Policy to restrict image sources to trusted domains only.
Content-Security-Policy: img-src 'self' trusted-cdn.example.com;
🧯 If You Can't Patch
- Implement strict input validation on all user-controlled fields that could affect srcset attributes
- Deploy web application firewall (WAF) rules to detect and block suspicious srcset attribute patterns
🔍 How to Verify
Check if Vulnerable:
Check AngularJS version in application dependencies. If version is 1.3.0-rc.4 or higher and application uses srcset attributes with user input, it's vulnerable.Check Version:
Check package.json for AngularJS version or inspect loaded AngularJS library version in browser developer toolsVerify Fix Applied:
Test that custom sanitization properly validates srcset URLs and CSP headers are correctly implemented and enforced.📡 Detection & Monitoring
Log Indicators:
- Unusual srcset attribute patterns in request logs
- Multiple failed image loads from unexpected domains
Network Indicators:
- Image requests to unexpected or suspicious domains
- Patterns of srcset attributes with encoded payloads
SIEM Query:
Search for web requests containing suspicious srcset patterns or image loads from non-whitelisted domains