CVE-2020-7676: Cross Site Scripting vulnerability in angular (npm)

What is CVE-2020-7676 About?

This Cross Site Scripting (XSS) vulnerability in Angular.js allows an attacker to bypass sanitization by wrapping `<option>` elements in `<select>` ones. This changes HTML parsing behavior, enabling injection of unsanitized code into the DOM. Exploitation is possible if an attacker can control user-supplied HTML content that is rendered by a vulnerable Angular.js application.

Affected Software

angular <1.8.0

Technical Details

Angular.js versions prior to 1.8.0 are susceptible to a Cross-Site Scripting (XSS) vulnerability related to its sanitization mechanisms. The issue arises when the regex-based input HTML replacement, intended for sanitization, can be circumvented. Specifically, wrapping <option> elements within <select> elements can alter the HTML parsing behavior in such a way that previously sanitized or expectedly safe code becomes unsanitized. An attacker can craft malicious HTML containing JavaScript code within <option> tags, and then enclose these in <select> tags. When Angular.js processes this, the parsing context shift allows the embedded script to bypass the sanitization regex, leading to its execution in the user's browser.

What is the Impact of CVE-2020-7676?

Successful exploitation may allow attackers to execute arbitrary script code in the context of the user's browser, leading to session hijacking, data theft, or defacement.

What is the Exploitability of CVE-2020-7676?

Exploitation of this Cross Site Scripting vulnerability has a moderate complexity. An attacker needs to be able to inject specific crafted HTML content into a webpage rendered by a vulnerable Angular.js application. Prerequisites include allowing user-supplied HTML that is then dynamically rendered without sufficient sanitization. Authentication requirements depend on whether the content injection vector (e.g., comment section, profile editor) is accessible to unauthenticated users. Privilege requirements are typically low, as the attack targets the client-side browser. This is primarily a remote exploitation scenario, where a malicious user provides input to a web application. The risk is heightened in web applications that embed or reflect user-controlled HTML content, especially in older Angular.js deployments.

What are the Known Public Exploits?

PoC Author	Link	Commentary
No known exploits

What are the Available Fixes for CVE-2020-7676?

A Fix by Resolved Security Exists!

Learn how our approach backports security patches directly to your dependencies.

About the Fix from Resolved Security

None

Available Upgrade Options

angular
- <1.8.0 → Upgrade to 1.8.0

Struggling with dependency upgrades?

See how Resolved Security's drop-in replacements make it simple.

Book a demo

Additional Resources

What are Similar Vulnerabilities to CVE-2020-7676?

Similar Vulnerabilities: CVE-2021-23386 , CVE-2021-3640 , CVE-2020-7763 , CVE-2020-7704 , CVE-2016-10557

CVE-2020-7676 Cross Site Scripting vulnerability in angular (npm)