PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Adapting AngularJS payloads to exploit real world applications

portswigger.net | research | #xss | #template-injection | #payloads | #uber | #angularjs | #piwik
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Gareth Heyes adapts AngularJS template-injection payloads to bypass real-world filters: lower-case conversion at Piwik and a no-quotes policy at Uber. Both flaws enabled account hijacking.
Published
Collected

Related coverage

research · portswigger.net
XSS without HTML: Client-Side Template Injection with AngularJS
Gareth Heyes explains client-side template injection in AngularJS and presents a fresh sandbox escape affecting Angular 1.3.1+ and 1.4.0+, enabling XSS even when user input is HTML-encoded.
research · portswigger.net
Our favourite community contributions to the XSS cheat sheet
A rundown of the seven best community submissions to PortSwigger's XSS cheat sheet: shorter Vue and AngularJS vectors, the obscure onbeforeinput event, and a WAF-evading base64-encoded payload.
research · portswigger.net
Server-Side Template Injection
James Kettle's seminal paper on server-side template injection: a detection and exploitation methodology, generic exploits for five template engines, sandbox escapes and RCE zero-days.
research · portswigger.net
Ambushed by AngularJS: a hidden CSP bypass in Piwik PRO
A DOM Invader audit of Piwik PRO uncovered an AngularJS-based debugger whose script gadgets can bypass CSP; with an HTML injection, events like ng-focus could execute code despite the policy.
research · portswigger.net
AngularJS CSP bypass in 56 characters
Gareth Heyes chronicles trimming an AngularJS CSP bypass payload from 63 to 56 characters by exploiting the path property and filter syntax, evading the framework's window detection.
research · portswigger.net
DOM based AngularJS sandbox escapes
Gareth Heyes develops a DOM-based AngularJS sandbox escape in the previously unexploitable orderBy filter, tracing the framework's sandbox history and exploit development.
Back