CVE-2024-8373 AngularJS improper sanitization in '<source>' element
Attackers can bypass image source restrictions and perform content spoofing via improper sanitization in AngularJS source elements.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-8373?
CVE-2024-8373 is a medium-severity cross-site scripting vulnerability in Netapp Active Iq Unified Manager, published on 9 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .
This issue affects all versions of AngularJS.
Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
Weakness: CWE-791
Which versions are affected by CVE-2024-8373?
2 open source packages ship an affected version, including angular. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
angular npm | All versions to 1.8.3 | None |
angular npm | All versions to 1.8.3 | None |
Products include Angularjs Angularjs, Netapp Active Iq Unified Manager.
How do I fix CVE-2024-8373?
Product is end of life, replace it.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-8373 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-8373 exists.
Other vulnerabilities in Netapp Active Iq Unified Manager
- CVE-2019-10768 angular Prototype Pollution vulnerability
- CVE-2019-14863 AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes
- CVE-2020-7676 Angular vulnerable to Cross-site Scripting
- CVE-2023-26116 angular vulnerable to regular expression denial of service via the angular.copy() utility
- CVE-2023-26117 angular vulnerable to regular expression denial of service via the $resource service
Sources
Also known as DEBIAN-CVE-2024-8373, GHSA-mqm9-c95h-x2p6, MINI-wwcp-p98w-9r5v, ROOT-APP-NPM-CVE-2024-8373, UBUNTU-CVE-2024-8373.