Skip to content

Commit 047dff8

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-45q2-gjvg-7973 GHSA-jj8c-mmj3-mmgv
1 parent 36344dd commit 047dff8

File tree

2 files changed

+190
-0
lines changed

2 files changed

+190
-0
lines changed

‎advisories/github-reviewed/2026/04/GHSA-45q2-gjvg-7973/GHSA-45q2-gjvg-7973.json‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-45q2-gjvg-7973",
4+
"modified": "2026-04-16T22:36:01Z",
5+
"published": "2026-04-16T22:36:01Z",
6+
"aliases": [],
7+
"summary": "Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server",
8+
"details": "### Impact\n\nA [Server-Side Request Forgery (SSRF)](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/SSRF) vulnerability exists in `@angular/platform-server` due to improper handling of URLs during Server-Side Rendering (SSR).\n\nWhen an attacker sends a request such as `GET /\\evil.com/ HTTP/1.1` the server engine (Express, etc.) passes the URL string to Angular’s rendering functions.\n\nBecause the URL parser normalizes the backslash to a forward slash for HTTP/HTTPS schemes, the internal state of the application is hijacked to believe the current origin is `evil.com`. This misinterpretation tricks the application into treating the attacker’s domain as the local origin. Consequently, any relative `HttpClient` requests or `PlatformLocation.hostname` references are redirected to the attacker controlled server, potentially exposing internal APIs or metadata services.\n\n**Affected APIs:**\n- `renderModule`\n- `renderApplication`\n- `CommonEngine` (from `@angular/ssr`)\n\n**Non-Affected APIs:**\n- `AngularAppEngine` (from `@angular/ssr`)\n- `AngularNodeAppEngine` (from `@angular/ssr`)\n\n### Attack Preconditions\n- The server has outbound network access.\n- The application uses Angular SSR via the affected APIs.\n- A pathname is passed as URL to the rendering method (e.g. using `req.url`).\n- The server-side code performs HTTP requests using `HttpClient` with relative URLs or uses `PlatformLocation.hostname` to build URLs. \n\n\n### Patches\n- 22.0.0-next.8\n- 21.2.9\n- 20.3.19\n- 19.2.21\n\n### Workarounds\nDevelopers should implement a middleware to sanitize the request URL before it reaches Angular. This involves stripping or normalizing leading slashes:\n\n```js\napp.use((req, res, next) => {\n // Sanitize the URL to ensure it starts with a single forward slash\n if (req.url.startsWith('//') || req.url.startsWith('/\\\\') || req.url.startsWith('\\\\')) {\n req.url = '/' + req.url.replace(/^[/\\\\]+/, '');\n }\n next();\n});\n\n```\n### References\n- [Fix](https://github.com/angular/angular/pull/68194)",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "@angular/platform-server"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "22.0.0-next.0"
27+
},
28+
{
29+
"fixed": "22.0.0-next.8"
30+
}
31+
]
32+
}
33+
]
34+
},
35+
{
36+
"package": {
37+
"ecosystem": "npm",
38+
"name": "@angular/platform-server"
39+
},
40+
"ranges": [
41+
{
42+
"type": "ECOSYSTEM",
43+
"events": [
44+
{
45+
"introduced": "21.0.0-next.0"
46+
},
47+
{
48+
"fixed": "21.2.9"
49+
}
50+
]
51+
}
52+
]
53+
},
54+
{
55+
"package": {
56+
"ecosystem": "npm",
57+
"name": "@angular/platform-server"
58+
},
59+
"ranges": [
60+
{
61+
"type": "ECOSYSTEM",
62+
"events": [
63+
{
64+
"introduced": "20.0.0-next.0"
65+
},
66+
{
67+
"fixed": "20.3.19"
68+
}
69+
]
70+
}
71+
]
72+
},
73+
{
74+
"package": {
75+
"ecosystem": "npm",
76+
"name": "@angular/platform-server"
77+
},
78+
"ranges": [
79+
{
80+
"type": "ECOSYSTEM",
81+
"events": [
82+
{
83+
"introduced": "19.0.0-next.0"
84+
},
85+
{
86+
"fixed": "19.2.21"
87+
}
88+
]
89+
}
90+
]
91+
},
92+
{
93+
"package": {
94+
"ecosystem": "npm",
95+
"name": "@angular/platform-server"
96+
},
97+
"ranges": [
98+
{
99+
"type": "ECOSYSTEM",
100+
"events": [
101+
{
102+
"introduced": "0"
103+
},
104+
{
105+
"last_affected": "18.2.14"
106+
}
107+
]
108+
}
109+
]
110+
}
111+
],
112+
"references": [
113+
{
114+
"type": "WEB",
115+
"url": "https://github.com/angular/angular/security/advisories/GHSA-45q2-gjvg-7973"
116+
},
117+
{
118+
"type": "WEB",
119+
"url": "https://github.com/angular/angular/pull/68194"
120+
},
121+
{
122+
"type": "PACKAGE",
123+
"url": "https://github.com/angular/angular"
124+
}
125+
],
126+
"database_specific": {
127+
"cwe_ids": [
128+
"CWE-918"
129+
],
130+
"severity": "HIGH",
131+
"github_reviewed": true,
132+
"github_reviewed_at": "2026-04-16T22:36:01Z",
133+
"nvd_published_at": null
134+
}
135+
}

‎advisories/github-reviewed/2026/04/GHSA-jj8c-mmj3-mmgv/GHSA-jj8c-mmj3-mmgv.json‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jj8c-mmj3-mmgv",
4+
"modified": "2026-04-16T22:38:03Z",
5+
"published": "2026-04-16T22:38:03Z",
6+
"aliases": [],
7+
"summary": "Authlib: Cross-site request forging when using cache",
8+
"details": "### Summary\n\nThere is no CSRF protection on the cache feature on most integrations clients.\n\n### Details\nIn `authlib.integrations.starlette_client.OAuth`, no CSRF protection is set up when using the cache parameter. When _not_ using the cache parameter, the use of SessionMiddleware ties the client to the auth state, preventing CSRF attacks. With the cache, there is no such mechanism. Other integratons have the same issue, it's not just starlette.\n\nThe state parameter is taken from the callback URL and the state is fetched from the cache without checking that it is the same client calling the redirect endpoint as was the one that initiated the auth flow.\n\nThis issue is documented in RFC 6749 section 10.12:\nhttps://datatracker.ietf.org/doc/html/rfc6749#section-10.12\n\n### PoC\n- Set up a Starlette integration with a cache\n- The attacker starts the auth flow up until before the callback URL is followed.\n- The attacked sends the redirect URL to the victim\n- The victim now completes the authorisation\n\n### Impact\nThis impacts all users that use the cache to store auth state.\n\nAll users will be vulnerable to CSRF attacks and may have an attacker's account tied to their own. In our specific scenario, this allowed attackers to push invoices into a victim's account, ready to be paid. Very serious.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "PyPI",
19+
"name": "authlib"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "1.6.11"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/authlib/authlib/security/advisories/GHSA-jj8c-mmj3-mmgv"
40+
},
41+
{
42+
"type": "PACKAGE",
43+
"url": "https://github.com/authlib/authlib"
44+
}
45+
],
46+
"database_specific": {
47+
"cwe_ids": [
48+
"CWE-352"
49+
],
50+
"severity": "MODERATE",
51+
"github_reviewed": true,
52+
"github_reviewed_at": "2026-04-16T22:38:03Z",
53+
"nvd_published_at": null
54+
}
55+
}

0 commit comments

Comments
 (0)