Server-side rendering vulnerabilities could allow attackers to steal authorization headers or perpetrate phishing and SEO hacking.
The Angular team from Google has announced the release of two security updates to the Angular web framework, both pertaining to SSR (server-side rendering) vulnerabilities. Developers are advised to update SSR applications as soon as possible. Patching can help users avoid the theft of authorization headers as well as phishing scams.
A bulletin on the issues was published
February 28. One of the vulnerabilities, labeled as
critical, pertains to SSRF (server-side request
forgery) and header injection. The patched version
can be found
here. The second vulnerability, labeled as moderate,
pertains to an open redirect via the
X-Forwarded-Prefix header. That patch
can be found
here.
The SSRF vulnerability found in the Angular SSR
request handling pipeline exists because Angular’s
internal URL reconstruction logic directly trusts
and consumes user-controlled HTTP headers,
specifically the host and
X-Forwarded-* family, to determine
the application’s base origin without validation
of the destination domain. This vulnerability
manifests through implicit relative URL
resolution, explicit manual construction, and
confidentiality breach, the Angular team said.
When exploited successfully, this SSRF
vulnerability allows for arbitrary internal
request steering. This can lead to the stealing
sensitive Authorizationheaders or
session cookies by redirecting them to an
attacker’s server. Attackers also can access and
transmit data from internal services, databases,
or cloud metadata endpoints not exposed to the
public internet. Also, attackers could access
sensitive information processed within the
application’s server-side context.
The open redirect vulnerability, meanwhile, exists in the internal URL processing logic in Angular SSR. This vulnerability allows attackers to conduct large-scale phishing and SEO hijacking, the Angular team said.
The team recommends updating SSR applications to
the latest patch version as soon as possible. If
an app does not deploy SSR to production, there is
no immediate need to update, they said. Developers
on an unsupported version of Angular or unable to
update quickly are advised to avoid using
req.headers for URL construction. Instead, they
should use trusted variables for base API paths.
Another workaround is implementing a middleware in
the server.ts to enforce numeric ports and
validated hostnames.
