The vulnerability arises from a parser differential in @angular/platform-server where the strict WHATWG URL parser used for validating host allowlists rejects malformed URLs with double ports (e.g., http://evil.com:80:80), skipping host validation. However, the Domino URL parser later leniently accepts and resolves such URLs to http://evil.com:80. This discrepancy allows attackers to bypass the allowedHosts check and redirect server-side relative HTTP requests to arbitrary external endpoints. The SSR HTTP request interceptor then uses this resolved origin, enabling SSRF attacks and potential response injection into the server-rendered DOM. Successful exploitation requires active SSR, propagation of raw client URL inputs, use of relative outbound HTTP requests, and enabled allowedHosts checks. The vulnerability affects versions <=18.2.14 and is patched in versions 19.2.23 and later.

Attackers can bypass host allowlist constraints in Angular server-side rendering applications, redirecting backend API requests carrying sensitive credentials and tokens to attacker-controlled servers. This can lead to unauthorized data exposure, SSRF attacks, and injection of malicious content into the server-rendered HTML, potentially compromising end-user security and application integrity.

Fixed versions are available starting from 19.2.23 and later. Users should upgrade @angular/platform-server to version 19.2.23 or higher to remediate this vulnerability. Until upgraded, applications should avoid relying solely on allowedHosts for host validation and carefully validate and sanitize incoming URLs and Host headers used in SSR contexts. Patch status is confirmed by the vendor advisory indicating fixes in 19.2.23, 20.3.22, 21.2.15, and 22.0.0-rc.2.