An Abusive Relationship with AngularJS
summary
Shows concrete failings: repeated sandbox bypasses in AngularJS 1.x (constructor/.__proto__/toString tricks, later charAt override) that regain DOM access; sanitizer weaknesses (old parser, Chrome mutation/AMXSS via SVG use) and a real-world SVG animate xlink:href whitelist bug that slipped into an RC and could cause XSS; multiple CSP-blob+reflect.construct exploit paths including blob URLs and CDN-overwrite attacks that defeat CSP. Demonstrations use live payloads, version numbers (1.1.x, 1.2, 1.4.9, 1.5.5, RC1) and a proof-of-concept chain that is fixed only at last minute.
AI-written summary · about
chapters (10)
- 0:00Start
- 16:10Current State What about versions 1.3.2 to latest? . Any publicly known sandbox bypasses? - Access to pretty much everything has been restricted - No window, no Function, no object, no call() or apply , no document, no DOM nodes
- 21:10The Sanitizer • AngularJS has an integrated HTML sanitizer. . It's a component called Ssanitize. . It's purpose is to wash away XSS attacks from a string of HTML . And return a clean string of HTML ready for safe and secure usage. . There is two major versions, one horrible version, one that's not so bad.
- 21:42The Old Sanitizer The Old Sanitizer uses an actual HTML parser from 2008 . That old thing from John E. Resig. - It's extremely strict, hard to configure, crashes literally all the time - We published a test-case where you can play with it. . And it can be bypassed if some likely prerequisites are met. - Because of Chrome . Also, a friendly hat-tip to Gareth Heyes!
- 23:08The New Sanitizer • The New Sanitizer is still ugly. But it uses the DOM instead of a parser
- 25:29Attacking the CSP Mode Contrary to many other frameworks, AngularJS works well together with CSP CSP? Content Security Policy
- 26:47Early CSP Bypasses The first spotted bypasses were trivial to say the least. Just use Framework features. . Take a website with strong CSP and older Angular - Find an injection
- 36:00Attacking the Code-Base What does an attacker do it no exploitable bugs can be found? Of course. We attack the project itselt . And use the power of open source to introduce changes that cause the bugs we want . And thereby get both praise for reporting a bug . We did that to Angularjs. . Google Security knew in advance. Angularjs did not
- 36:47The Con-Setup . We needed a subtle bug that upon being fixed would raise a security issue . Or smuggle in a pull request that looks unsuspicious enough to pass OA . The first option is unlikely, like a lottery win. . The second option is a bit more risky, what if we get detected?
- 40:52The Execution . So, if that specific behavior observed in the sanitizer blocks a bypass... . We need to file a bug to get it fixed! • The bug. Not the bypass : . So we did that. . And it got accepted!
