Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system. With a more complex (undisclosed) payload, one can get full access to Arbitrary code execution on the system. The problem has been patched in version 1.4.3 of Angular Expressions. Two possible workarounds are available. One may either disable access to __proto__ globally or make sure that one uses the function with just one argument.
To demonstrate the vulnerability, we have created a simple Node.js application that uses the vulnerable version of Angular Expressions. The application exposes an endpoint /parse that evaluates user-provided expressions.
-
Clone the repository:
git clone https://github.com/example/CVE-2024-54152-poc.git cd CVE-2024-54152-poc -
Build and run the Docker container:
docker build -t vulnerable-app . docker run -p 8080:8080 vulnerable-app -
Send the malicious payload: You can use either the provided Go or Python script to send the payload.
-
Using Go:
go run poc.go
-
Using Python:
python3 poc.py
-
The server should execute the payload and return the result of the id command, demonstrating arbitrary code execution.
To mitigate this vulnerability, update Angular Expressions to version 1.4.3 or later. Alternatively, you can disable access to __proto__ globally or ensure that the function is used with only one argument.