CVE-2024-54152: Angular Expressions - Remote Code Execution when using locals
Impact An attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system. Example of vulnerable code: With a more complex (undisclosed) payload, one can get full access to Arbitrary code execution on the system. Patches The problem has been patched in version 1.4.3 of angular-expressions.
Published Dec 10, 2024
Affected packages
angular-expressions
- Ecosystem
- npm
- Affected
- < 1.4.3
- Fixed in
- 1.4.3
- Check
npm ls angular-expressions
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
An attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system.
Example of vulnerable code:
const expressions = require("angular-expressions");
const result = expressions.compile("__proto__.constructor")({}, {});
// result should be undefined, however for versions <=1.4.2, it returns an object.With a more complex (undisclosed) payload, one can get full access to Arbitrary code execution on the system.
Patches
The problem has been patched in version 1.4.3 of angular-expressions.
Workarounds
There is one workaround if it not possible for you to update :
- Make sure that you use the compiled function with just one argument : ie this is not vulnerable :
const result = expressions.compile("__proto__.constructor")({});: in this case you lose the feature of locals if you need it.
Credits
Credits go to JorianWoltjer who has found the issue and reported it to use. https://jorianwoltjer.com/
Credited to JorianWoltjer.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology