GHSA-r3hf-q8q7-fv2p Angular critical CSS inlining Cross-site Scripting Vulnerability Advisory

Not scored Published 9 Aug 2023

Attacker can inject malicious JavaScript into Angular Universal apps using critical CSS inlining, requiring user interaction to execute.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is GHSA-r3hf-q8q7-fv2p?

GHSA-r3hf-q8q7-fv2p is a cross-site scripting vulnerability in @nguniversal/common, published on 9 Aug 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Impact

Angular Universal applications on 16.1.0 and 16.1.1 using critical CSS inlining are vulnerable to a cross-site scripting (XSS) attack where an attacker can trick another user into visiting a page which injects malicious JavaScript.

Angular CLI applications without Universal do perform critical CSS inlining as well, however exploiting this requires a malicious actor to already have access to modify source code directly.

Patches

@nguniversal/common should be upgraded to 16.1.2 or higher. 16.2.0-rc.0 is safe.

Workarounds

The easiest solution is likely to upgrade Universal to 16.1.2 or downgrade to 16.0.x or lower. Alternatively you can override specifically the critters dependency with version 0.0.20 in your package.json.

{
  &#34;overrides&#34;: {
    &#34;critters&#34;: &#34;0.0.20&#34;
  }
}

References

Angular Blog Post

Which versions are affected by GHSA-r3hf-q8q7-fv2p?

2 open source packages ship an affected version, including @nguniversal/common.

Package	Affected	Fixed in
`@nguniversal/common` npm	From `16.1.0`	`16.1.2`
`@nguniversal/common` npm	From `16.1.0`	`16.1.2`

How do I fix GHSA-r3hf-q8q7-fv2p?

Upgrade @nguniversal/common to 16.1.2 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is GHSA-r3hf-q8q7-fv2p being exploited?

There is no known exploitation of GHSA-r3hf-q8q7-fv2p in the wild and no public exploit code.