PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

XSS without HTML: Client-Side Template Injection with AngularJS

portswigger.net | research | #appsec | #web-security | #xss | #sandbox-escape | #template-injection | #client-side | #angularjs
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Gareth Heyes explains client-side template injection in AngularJS and presents a fresh sandbox escape affecting Angular 1.3.1+ and 1.4.0+, enabling XSS even when user input is HTML-encoded.
Published
Collected

Related coverage

research · portswigger.net
Adapting AngularJS payloads to exploit real world applications
Gareth Heyes adapts AngularJS template-injection payloads to bypass real-world filters: lower-case conversion at Piwik and a no-quotes policy at Uber. Both flaws enabled account hijacking.
research · portswigger.net
Server-Side Template Injection
James Kettle's seminal paper on server-side template injection: a detection and exploitation methodology, generic exploits for five template engines, sandbox escapes and RCE zero-days.
research · portswigger.net
Ambushed by AngularJS: a hidden CSP bypass in Piwik PRO
A DOM Invader audit of Piwik PRO uncovered an AngularJS-based debugger whose script gadgets can bypass CSP; with an HTML injection, events like ng-focus could execute code despite the policy.
research · portswigger.net
AngularJS CSP bypass in 56 characters
Gareth Heyes chronicles trimming an AngularJS CSP bypass payload from 63 to 56 characters by exploiting the path property and filter syntax, evading the framework's window detection.
research · portswigger.net
Widespread prototype pollution gadgets
Client-side prototype pollution gadgets in browser APIs: polluting Object.prototype can inject fetch bodies or defeat Object.defineProperty locks, with similar gadgets found across common libraries.
research · portswigger.net
Our favourite community contributions to the XSS cheat sheet
A rundown of the seven best community submissions to PortSwigger's XSS cheat sheet: shorter Vue and AngularJS vectors, the obscure onbeforeinput event, and a WAF-evading base64-encoded payload.
Back