Threats Tagged 'ghsa-rgjc-h3x7-9mwg'

Angular's client hydration feature in Server-Side Rendered (SSR) environments uses a predictable DOM element ID ('ng-state') to store serialized runtime state, including cached HTTP responses. This predictable ID allows an attacker to perform DOM Clobbering by injecting an element with the same ID before the genuine script tag is parsed. As a result, Angular may parse attacker-controlled JSON as part of its TransferState cache, enabling HTTP response cache poisoning. This can lead to DOM-based XSS, privilege escalation, or UI hijacking depending on how the poisoned data is used by the application. Patched versions 20.3.25, 21.2.17, and 22.0.1 address this issue. Workarounds include avoiding user-controlled IDs and configuring a custom, unpredictable APP_ID to change the state element's ID.