Compliance Impact

The vulnerability allows Cross-Site Scripting (XSS) attacks by injecting malicious scripts into the browser context, which can lead to session hijacking, credential theft, or unauthorized actions.

Such security issues can impact compliance with common standards and regulations like GDPR and HIPAA, as these require protection of user data and prevention of unauthorized access or data breaches.

Failure to mitigate this vulnerability could result in exposure of sensitive personal or health information, violating data protection requirements and potentially leading to legal and regulatory consequences.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is a Cross-Site Scripting (XSS) issue in Angular's Server-Side Rendering (SSR) platform, specifically in the @angular/platform-server package's dependency called domino. When dynamic text content is rendered inside a <noscript> element using template bindings like {{ value }} or [textContent], domino fails to properly escape the closing </noscript> tag during HTML serialization.

Because domino treats <noscript> as a raw-text element but omits it from the list of elements requiring closing-tag escaping, an attacker can inject a </noscript> tag in the bound text. This prematurely closes the <noscript> block, allowing any subsequent injected <script> tags to execute in the user's browser context, leading to a same-origin XSS attack.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute arbitrary JavaScript in the context of your web application by injecting malicious scripts through user-controlled data bound inside <noscript> elements during SSR.

The impact includes potential session hijacking, credential theft, unauthorized actions on behalf of the user, and other malicious activities that exploit the user's browser privileges within the same origin.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting server-side rendered HTML responses for unescaped </noscript> tags inside <noscript> elements, especially when dynamic text content is bound via Angular template bindings such as {{ value }} or [textContent].

One approach is to capture HTTP responses from your Angular SSR application and search for occurrences of </noscript> within <noscript> blocks that could indicate injection.

• Use curl or wget to fetch the page content: curl -s https://your-angular-app.example.com/page > response.html
• Use grep or similar tools to search for unescaped </noscript> tags inside <noscript> elements: grep -Poz '<noscript>.*?</noscript>' response.html | grep '</noscript>'
• Manually review or automate scanning of the captured HTML for injected script tags following premature closing of <noscript> elements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Angular to a fixed version where this vulnerability is resolved, specifically versions 22.0.0-rc.2, 21.2.16, 20.3.24, or 19.2.25.

If upgrading is not immediately possible, avoid binding user-controlled or dynamic text content inside <noscript> elements in your Angular SSR application.

Alternatively, sanitize or strip any closing </noscript> tags from user input before rendering to prevent premature closing of <noscript> blocks.

Useful 0 Not Useful 0