An Abusive Relationship with AngularJS v2
summary
Deep dive into AngularJS 1.x vulnerabilities with concrete exploits and timelines: sandbox bypass via Function constructor and prototype/toString tricks (multiple generations of bypasses, one fix taking 120 days), sanitizer SVG use-element and legacy parser bypass (old $sanitize allows SVG; new sanitizer forbids it), CSP bypass using ng-click + Blob + Reflect.construct to escape CSP, and CDN downgrade and repository whitelist bug that turns a reported fix into XSS. Includes PoCs, attack counts and practical mitigation tradeoffs.
AI-written summary · about
chapters (23)
- 0:00Intro
- 1:29What is AngularJS?
- 4:40Relationship Reasons
- 5:20The Honey Boo Boo of MVC?
- 8:44The AngularJS Sandbox
- 9:44First Bypasses
- 11:20More Bypasses
- 15:31Extreme Bypasses
- 19:14A1: User Interaction
- 19:52The Sanitizer
- 20:21The Old Sanitizer
- 21:50The New Sanitizer
- 24:36Attacking the CSP Mode
- 25:07Early CSP Bypasses
- 29:52Universal CSP Bypass
- 33:22Attacking the Code-Base
- 34:04The Con-Setup
- 34:34The Bug
- 36:16The Execution
- 36:56The Bypass
- 38:35A4: The Aftermath
- 39:48A Quick Conclusion
- 41:38The End
related talks
51mAn Abusive Relationship with AngularJS
49mAn Abusive Relationship with AngularJS
23mJavaScript attack surface
32mHow to hack an Angular app?
31mAngular and the OWASP top 10
47mFrom Theory To Practice: Navigating The Challenges Of Vulnerability Research
30mHow to hack an Angular app?
21mHow to hack an Angular app?