CVE-2024-8372 AngularJS improper sanitization in 'srcset' attribute
Attackers can bypass image source restrictions and perform content spoofing via improper sanitization in the srcset attribute of the End-of-Life AngularJS library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-8372?
CVE-2024-8372 is a medium-severity cross-site scripting vulnerability in Netapp Active Iq Unified Manager, published on 9 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .
This issue affects AngularJS versions 1.3.0-rc.4 and greater.
Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
Weakness: CWE-1289
Which versions are affected by CVE-2024-8372?
2 open source packages ship an affected version, including angular. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
angular npm | From 1.3.0-rc.4 to 1.8.3 | None |
angular npm | From 1.3.0-rc.4 to 1.8.3 | None |
Products include Angularjs Angularjs, Netapp Active Iq Unified Manager.
How do I fix CVE-2024-8372?
Product is end of life, replace it.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-8372 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-8372 exists.
Other vulnerabilities in Netapp Active Iq Unified Manager
- CVE-2019-10768 angular Prototype Pollution vulnerability
- CVE-2019-14863 AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes
- CVE-2020-7676 Angular vulnerable to Cross-site Scripting
- CVE-2023-26116 angular vulnerable to regular expression denial of service via the angular.copy() utility
- CVE-2023-26117 angular vulnerable to regular expression denial of service via the $resource service
Sources
Also known as DEBIAN-CVE-2024-8372, GHSA-m9gf-397r-hwpg, MINI-fjxv-8c87-fp6h, ROOT-APP-NPM-CVE-2024-8372, UBUNTU-CVE-2024-8372.