Angular < 20.3.33 Multiple Vulnerabilities

medium Web App Scanning Plugin ID 115568

Synopsis

Description

According to its self-reported version number, Angular is prior to 20.0.0, 20.x prior to 20.3.33, 21.x prior to 21.2.25 or 22.x prior to 22.2.1. It is, therefore, affected by multiple vulnerabilities:

- An open redirect vulnerability in @angular/platform-server when Server-Side Rendering (SSR) is enabled. A request URL containing a popping dot-segment followed by multiple slashes (such as /.//evil.test) bypasses the protocol-relative URL check performed before URL normalization, causing the SSR engine to emit a redirect to an attacker-controlled external domain. (GHSA-w739-gvwx-grc3)

- A denial of service vulnerability in @angular/router when Server-Side Rendering (SSR) is enabled and RouterLink directives use the merge or preserve query parameters handling. Each rendered link retains a copy of the incoming request query parameters until the SSR response completes, allowing an unauthenticated remote attacker to exhaust the Node.js memory heap with crafted query strings. This issue only affects versions 21.2.0 and later. (GHSA-57xq-rjx2-v5xh)

- A denial of service vulnerability in @angular/router when Server-Side Rendering (SSR) is enabled. The router does not reject unconfigured empty-path auxiliary outlet segments during route matching, allowing an unauthenticated remote attacker to send URLs with many crafted outlet segments to exhaust the Node.js memory heap or CPU resources. (GHSA-62vg-58rm-qff7)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.