Angular @angular/compiler Two-Way Binding Sanitization Bypass XSS (CVE-2024-54265)

Vulnerability Overview Vulnerability Name: Two-Way Property Binding Sanitization Bypass (XSS) Description: In the package, DOM property sanitization can be bypassed via two-way property bindings. Specifically, when native DOM properties that require sanitization (such as , , , , , or ) are bound using two-way binding syntax (e.g., or ), the Angular template compiler does not apply the appropriate schema-derived sanitizer resolution to operations. Consequently, neither of the two-way DOM bindings is filtered by sanitization rules, whereas equivalent one-time bindings are correctly sanitized. Impact: Any application that uses two-way data binding ( or ) for security-sensitive native DOM properties (such as , , , , etc.) is susceptible to this security bypass. Once exploited, an attacker can provide an unsanitized property binding value, bypassing core sanitization constraints. This may lead to the execution of arbitrary JavaScript in the context of the victim's browser, resulting in session hijacking, sensitive data leakage, or unauthorized actions. Affected Versions Affected Versions: - - - - Fixed Versions: - - - Remediation Patch Versions: - - - Attack Prerequisites To successfully exploit this vulnerability, the following environmental parameters and application states must coexist: 1. Two-way binding on sensitive properties: The application must use two-way binding syntax (e.g., ) to bind to sensitive native DOM properties. 2. User-controlled input: The value bound to that property must be influenceable via user-controlled input. 3. Lack of additional sanitization: The application does not perform separate manual sanitization (e.g., via ) before passing the value to the property binding. References CVE ID: CVE-2024-54265 Additional Information CVSS v4 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: None - Privileges Required: None - User Interaction: Passive - Vulnerable System Impact Metrics: - Confidentiality: Low - Integrity: Low - Availability: Low - Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None Weakness: CWE-79 Contributors: - Reporter: Eay2nnZx - Other: alan-agius4 - Fix Reviewers: JeanMeche, JoostK

Goal Reached Thanks to every supporter — we hit 100%!

Angular @angular/compiler Two-Way Binding Sanitization Bypass XSS (CVE-2024-54265)

More from this source