WARNING: A CRITICAL VULNERABILITY IS AFFECTING ANGULAR EXPRESSIONS
Sources
https://github.com/peerigon/angular-expressions/security/advisories/GHSA-5462-4vcx-jh7j
Risks
The present vulnerability has a HIGH impact on Confidentiality, Integrity and Availability.
Moreover, a Proof-of-Concept exploit has been published, thus rendering the exploitation of this vulnerability a lot easier for attackers.
Description
CVE-2024-54152 allows an attacker to write a malicious expression that escapes the sandbox to execute arbitrary code on the underlying system.
Recommended Actions
Patch
The Centre for Cybersecurity Belgium strongly recommends installing updates for the vulnerable software mentioned in the present advisory.
Workaround
Two possible workarounds are possible:
- Disable access to function "_ proto _" globally.
- Make sure to use the function with just one argument.
Monitor/Detect
The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity, ensuring a swift response in case of an intrusion.
In case of an intrusion, you can report an incident via: https://ccb.belgium.be/en/cert/report-incident
While patching appliances or software to the newest version may provide safety from future exploitation, it does not remediate historic compromise.