Angular HttpTransferCache 32-bit Hash Collision Leading to State Poisoning and Data Leakage (GHSA-39pv-4j6c-2g9v)

Vulnerability Overview Title: Weak 32-Bit Cache Key Hashing in Leading to Cross-Request Data Leakage and State Poisoning Description: Angular's caches HTTP requests during server-side rendering (SSR) for reuse during client-side hydration. This prevents the execution of duplicate HTTP requests on the client side. The cached responses are stored in using a cache key generated by hashing request attributes (method, response type, mapped URL, serialized body, and sorted query parameters). The cache key is generated using a 32-bit DJB2-style polynomial rolling hash. The 32-bit hash space is very small, allowing an attacker to find hash collisions. An attacker can easily find a query parameter string (e.g., for a search request) that produces the exact same 32-bit hash as a sensitive endpoint (e.g., ). When a victim visits a malicious link containing the colliding parameter, the SSR process will execute both the search request and the profile request. Due to the hash collision, the search response will overwrite the profile request's data in the cache. Impact State Poisoning: The application runs with attacker-supplied data, which can lead to bypassing client-side security controls or enabling DOM-based cross-site scripting (XSS) if the data is rendered unsafely. Information Leakage: If a sensitive response is incorrectly associated with an attacker's search results and rendered on the page, the victim's sensitive data may be leaked to the attacker. Remediation Patched Versions: 22.0.1 21.2.17 20.3.25 Framework-Level Fix: The logic has been updated to use the cryptographically secure SHA-256 hashing algorithm to generate cache keys within . The cache keys are now 256-bit hexadecimal strings. Workaround: If an immediate upgrade is not possible, configure your requests to skip the transfer cache for sensitive endpoints: Alternatively, disable HTTP transfer cache globally in the application bootstrap configuration: References GHSA-39pv-4j6c-2g9v Credit This vulnerability was discovered and reported by CodeMender from Google DeepMind.

Goal Reached Thanks to every supporter — we hit 100%!

Angular HttpTransferCache 32-bit Hash Collision Leading to State Poisoning and Data Leakage (GHSA-39pv-4j6c-2g9v)

More from this source