Angular @angular/platform-server Host Allowlist Bypass leading to SSRF (CVE-2025-50188)

Vulnerability Overview A vulnerability was discovered in that allows remote attackers to bypass host whitelist restrictions and directly launch Server-Side Request Forgery (SSRF) attacks. This vulnerability arises from discrepancies between the strict WHATWG URL parser and the more lenient Domino URL parser. Affected Versions Affected Versions: - - - - - Fixed Versions: - - - - Remediation Upgrade to the following versions to mitigate the vulnerability: Vulnerability Description When server-side rendering processes a malicious URL containing a double-dot path structure (e.g., ), Node's strict URL parser returns and skips the host validation check. However, the same malicious URL is subsequently accepted and parsed by Domino's internal parser, thereby directing the SSRF attack execution path to a server controlled by the attacker. Impact Any application utilizing server-side rendering ( ) and configured with a host routing whitelist is susceptible to this whitelist bypass vulnerability. By sending HTTP requests with malicious headers or absolute-form request URIs, an attacker can completely bypass the whitelist logic. SSR applications will route all relative HTTP outbound API queries (typically carrying sensitive credentials, session cookies, and internal authorization tokens) to the attacker-controlled server, resulting in response injection and content poisoning. Attack Preconditions 1. Server-Side Rendering (SSR) Enabled: The application must be configured to use Angular Server-Side Rendering. 2. Host Header/URI Propagation: The SSR handler must utilize client-supplied input (such as the request header or absolute-form URIs) and pass it to the rendering API via . 3. Outbound Relative HTTP Requests: The server application must execute outbound backend HTTP requests using relative paths. 4. Allowed Hosts Check Enabled: The server must use the framework-provided option to restrict valid server locations. References CVE-2025-50188 Additional Information CVSS v4 Base Metrics: - Severity: 8.8 / 10 - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: None - Privileges Required: None - User Interaction: None - Vulnerable System Impact Metrics: - Confidentiality: High - Integrity: Low - Availability: None - Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None CVE ID: CVE-2025-50188 Weaknesses: - CWE-346 - CWE-918 Contributors: - alan-agius4 (Fix Developer) - AndrewKushnir (Fix Reviewer) - josephperrott (Other) - OveRn1ght (Reporter)

Goal Reached Thanks to every supporter — we hit 100%!

Angular @angular/platform-server Host Allowlist Bypass leading to SSRF (CVE-2025-50188)

More from this source