An Abusive Relationship with AngularJS
summary
Detailed catalog of real exploits against AngularJS 1.x: multiple sandbox bypasses across AngularJS 1.x (constructor/proto/getPrototype tricks, array sort and toString abuses), a practical sanitizer XSS using SVG + browser quirks and SVG/sanitizer XSS via attribute lowercasing (fixes forced but initially introduced XSS), CSP workarounds including a theoretical Reflect/blob vector and a reliable attack where a malicious page loads an old build because of a collision check — CDN version overwrite collision causes universal CSP bypass. A tool to map bypasses by version is in progress.
AI-written summary · about
chapters (23)
- 0:00Start
- 5:26Relationship Reasons
- 6:45The Honey Boo Boo of MVC?
- 6:55Maybe Not
- 10:03The AngularJS Sandbox
- 11:22First Bypasses
- 12:37Al: First Fixes
- 16:39Extreme Bypasses
- 17:01Current State
- 19:50The Sanitizer
- 20:18The Old Sanitizer
- 21:42The New Sanitizer
- 23:38Attacking the CSP Mode
- 24:58Early CSP Bypasses
- 26:42Fixes and new Bypasses
- 29:06Universal CSP Bypass
- 32:46Attacking the Code-Base
- 33:27The Con-Setup
- 34:02The Bug
- 36:09A4: The Bypass
- 38:26A4: The Aftermath
- 40:54A Quick Conclusion
- 44:34The End
