Angular Expressions Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Angular Expressions versions through 1.5.1. The issue arises from the ability of an attacker to craft a malicious expression using filters that escape the sandbox, allowing arbitrary code execution on the system. This vulnerability has been addressed in version 1.5.2.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the system where Angular Expressions is used.

Reproduction

To reproduce this vulnerability, use a version of Angular Expressions prior to 1.5.2. Compile an expression that includes a filter, such as '__proto__', which is not defined. Instead of throwing an error, the expression execution will be bypassed, and a syntax error will be raised. This indicates that the filter was able to escape the sandbox. With a more complex, undisclosed payload, arbitrary code execution can be achieved.

Remediation

Users are advised to update Angular Expressions to version 1.5.2 or later.