CVE-2024-21490 angular vulnerable to super-linear runtime due to backtracking
Attackers can cause denial of service in AngularJS applications via catastrophic backtracking in the ng-srcset directive parser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-21490?
CVE-2024-21490 is a high-severity denial of service vulnerability in angular, published on 10 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. **Note:** This package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).
Weakness: CWE-1333
Which versions are affected by CVE-2024-21490?
6 open source packages ship an affected version, including org.webjars.bower:angular, org.webjars.npm:angular and angular. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.webjars.bower:angular Maven | From 1.3.0 to 1.8.3 | None |
org.webjars.bower:angular Maven | From 1.3.0 to 1.8.3 | None |
org.webjars.npm:angular Maven | From 1.3.0 to 1.8.3 | None |
org.webjars.npm:angular Maven | From 1.3.0 to 1.8.3 | None |
angular npm | From 1.3.0 to 1.8.3 | None |
angular npm | From 1.3.0 to 1.8.3 | None |
Products include Angularjs Angular.js.
How do I fix CVE-2024-21490?
Product is end of life, replace it.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-21490 being exploited?
There is no known exploitation of CVE-2024-21490 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2024-21490, GHSA-4w4v-5hc9-xrr2, MINI-p7r3-8rj6-5488, ROOT-APP-NPM-CVE-2024-21490, UBUNTU-CVE-2024-21490.