Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2021-21277— Angular Expressions - Remote Code Execution

Quick assessment

Affected
peerigon angular-expressions
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Peerigon angular-expressions是德国Peerigon公司的一个基于Javascript可用于提取浏览器节点的代码库。 angular-expressions 1.1.2 存在代码注入漏洞，该漏洞允许远程执行代码，攻击者可利用该漏洞可以运行任何浏览器脚本。

CVSS 8.5 · High EPSS 2.73% · P86

Possible ATT&CK Techniques 1 AI

T1059.007 · JavaScript
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-21277

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Angular Expressions - Remote Code Execution
Source: CVE Program / CVE List V5
Vulnerability Description
angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call "expressions.compile(userControlledInput)" where "userControlledInput" is text that comes from user input. The security of the package could be bypassed by using a more complex payload, using a ".constructor.constructor" technique. In terms of impact: If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput). If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution. This is fixed in version 1.1.2 of angular-expressions A temporary workaround might be either to disable user-controlled input that will be fed into angular-expressions in your application or allow only following characters in the userControlledInput.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Peerigon angular-expressions 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Peerigon angular-expressions是德国Peerigon公司的一个基于Javascript可用于提取浏览器节点的代码库。 angular-expressions 1.1.2 存在代码注入漏洞，该漏洞允许远程执行代码，攻击者可利用该漏洞可以运行任何浏览器脚本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
peerigon angular-expressions < 1.1.2 -

II. Public POCs for CVE-2021-21277

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-21277

请登录查看更多情报信息。

Patches & Fixes for CVE-2021-21277 (1)

Vendor Advisories for CVE-2021-21277 (1)

Other References for CVE-2021-21277 (1)

IV. Related Vulnerabilities

Same product: angular-expressions
Same vendor: peerigon
Same weakness: CWE-74