CVE-2025-66412

Executive Summary

CVE-2025-66412 is a Stored Cross-Site Scripting (XSS) vulnerability in the Angular Template Compiler. The flaw arises from an incomplete internal security schema that fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security. This allows attackers to bypass Angular's built-in sanitization and inject malicious scripts. The vulnerability affects all Angular versions prior to 19.2.17, 20.3.15, and 21.0.2. No public exploit code or proof-of-concept is currently available, but the risk is significant due to the widespread use of Angular in web applications.

Supply Chain & Package Security

Angular is distributed via npm (@angular/core, @angular/compiler, etc.). This vulnerability is a supply chain risk because any application using an affected version of Angular is vulnerable. Developers must update their package.json dependencies to a patched version. The Angular team has released patches, and the fix is available in the npm registry.

CVSS Breakdown & Threat Level

The CVSS score is currently 0.0 (unassigned). However, based on the nature of the vulnerability, a reasonable estimate would be:

• Attack Vector (AV): Network (N) - The attack is performed over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - The attacker needs to be able to input data that is stored and later rendered.
• User Interaction (UI): Required (R) - A user must view the page containing the malicious input.
• Scope (S): Changed (C) - The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): High (H) - An attacker could steal sensitive data.
• Integrity (I): High (H) - An attacker could modify content.
• Availability (A): Low (L) - The attack could potentially disrupt service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Threat Level: High. The vulnerability is easy to exploit, has a high impact, and affects a widely used framework.

Deep Dive & Mechanics

The vulnerability is in the Angular Template Compiler's security schema. Angular uses a security context to sanitize values bound to HTML attributes. For URL attributes (like href, src, action), Angular should sanitize the value to prevent javascript: URLs. However, the internal schema is incomplete, meaning some attributes that can accept URLs are not flagged as URL attributes. This allows an attacker to inject a javascript: URL into an attribute that Angular does not sanitize.

Attack Flow:

1. An attacker submits a payload containing a javascript: URL in a field that is bound to an unsanitized attribute.
2. The payload is stored in the application's database.
3. When a victim views the page, Angular renders the stored value without sanitization.
4. The victim's browser executes the javascript: URL, leading to XSS.

Root Cause: The Angular compiler's SecurityContext enum and the associated sanitization logic do not include all possible URL-holding attributes. For example, attributes like formaction, xlink:href, or custom attributes might be missed.

Vulnerable vs. Patched Code

Vulnerable Code (Angular < 19.2.17, < 20.3.15, < 21.0.2):

// In the compiler's security schema, certain attributes are not mapped to URL security context.
// Example: The 'formaction' attribute might be missing from the URL attribute list.
const URL_ATTRIBUTES = ['href', 'src', 'action']; // Incomplete list

Patched Code (Angular >= 19.2.17, >= 20.3.15, >= 21.0.2):

// The patched version includes a comprehensive list of URL-holding attributes.
const URL_ATTRIBUTES = [
  'href', 'src', 'action', 'formaction', 'xlink:href',
  // ... other attributes
];

The fix ensures that all attributes that can accept URLs are properly sanitized.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A vulnerable Angular application (version < 19.2.17, < 20.3.15, < 21.0.2).
• A field that accepts user input and is bound to an attribute like formaction or a custom attribute.

Exploit Payload:

<!-- Inject into a field that is bound to a vulnerable attribute -->
<input [formaction]="userInput" />

Where userInput is:

javascript:alert('XSS')

Steps:

1. Identify a form or element that uses an attribute not properly sanitized (e.g., formaction).
2. Submit the payload as the value for that attribute.
3. When a user interacts with the element (e.g., submits the form), the javascript: URL executes.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual javascript: URLs in user input.
• Use Content Security Policy (CSP) to block inline scripts.
• Implement input validation and output encoding.

Mitigation:

• Update Angular to a patched version immediately.
• Review custom directives and components for unsafe attribute bindings.
• Use Angular's DomSanitizer with caution and only when necessary.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing javascript: URLs in form fields or query parameters.
• Logs: Application logs showing javascript: URLs in stored data.
• File System: Modified templates or components that bypass sanitization.
• Memory: Injected scripts in the DOM.

Example IOC (Log Entry):

[2025-07-20 10:00:00] User input: javascript:alert('XSS') in field 'action'

Detection Engineering

YARA Rule

rule CVE_2025_66412_Angular_XSS {
    meta:
        description = "Detects potential exploitation of CVE-2025-66412 in Angular applications"
        author = "Valters IT"
        date = "2025-07-20"
        reference = "CVE-2025-66412"
    strings:
        $javascript_url = /javascript\s*:\s*\w+/i
        $angular_binding = /\[formaction\]|\[xlink:href\]/i
    condition:
        $javascript_url and $angular_binding
}

Sigma Rule

title: CVE-2025-66412 Angular XSS Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-66412 by injecting javascript: URLs into Angular bindings
author: Valters IT
date: 2025/07/20
logsource:
    category: application
    product: angular
detection:
    selection:
        - field: "formaction"
          value: "javascript:*"
        - field: "xlink:href"
          value: "javascript:*"
    condition: selection
falsepositives:
    - Legitimate use of javascript: URLs in rare cases
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66412 Angular XSS Attempt"; flow:to_server,established; content:"javascript:"; http_client_body; pcre:"/javascript\s*:\s*\w+/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Angular: Upgrade to version 19.2.17, 20.3.15, or 21.0.2.
2. Review Code: Audit all Angular templates for unsafe attribute bindings.
3. Implement CSP: Add a Content Security Policy that blocks inline scripts and javascript: URLs.

Long-Term Measures:

• Use Angular's built-in sanitization correctly.
• Regularly update dependencies.
• Conduct security training for developers.

Patch Details:

• Angular 19: Upgrade to 19.2.17
• Angular 20: Upgrade to 20.3.15
• Angular 21: Upgrade to 21.0.2

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For more information, visit Valters IT.