{"action":"closed","issue":{"url":"https://api.github.com/repos/jdbacx/test/issues/25","repository_url":"https://api.github.com/repos/jdbacx/test","labels_url":"https://api.github.com/repos/jdbacx/test/issues/25/labels{/name}","comments_url":"https://api.github.com/repos/jdbacx/test/issues/25/comments","events_url":"https://api.github.com/repos/jdbacx/test/issues/25/events","html_url":"https://github.com/jdbacx/test/issues/25","id":185125405,"number":25,"title":"Acunetix - AngularJS client-side template injection","user":{"login":"jdbacx","id":19711062,"avatar_url":"https://avatars.githubusercontent.com/u/19711062?v=3","gravatar_id":"","url":"https://api.github.com/users/jdbacx","html_url":"https://github.com/jdbacx","followers_url":"https://api.github.com/users/jdbacx/followers","following_url":"https://api.github.com/users/jdbacx/following{/other_user}","gists_url":"https://api.github.com/users/jdbacx/gists{/gist_id}","starred_url":"https://api.github.com/users/jdbacx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jdbacx/subscriptions","organizations_url":"https://api.github.com/users/jdbacx/orgs","repos_url":"https://api.github.com/users/jdbacx/repos","events_url":"https://api.github.com/users/jdbacx/events{/privacy}","received_events_url":"https://api.github.com/users/jdbacx/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/jdbacx/test/labels/Abuse_Of_Functionality","name":"Abuse_Of_Functionality","color":"ededed"},{"url":"https://api.github.com/repos/jdbacx/test/labels/bug","name":"bug","color":"ee0701"},{"url":"https://api.github.com/repos/jdbacx/test/labels/CWE-79","name":"CWE-79","color":"ededed"},{"url":"https://api.github.com/repos/jdbacx/test/labels/XSS","name":"XSS","color":"ededed"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-10-25T13:58:15Z","updated_at":"2016-10-26T09:13:57Z","closed_at":"2016-10-26T09:13:57Z","body":"| **Target URL** | http://testhtml5.vulnweb.com/|\n------------ | -------------\n| **Severity**   | High|\n\n##### Vulnerability Description\nThis web application is vulnerable to AngularJS client-side template injection vulnerability. AngularJS client-side template injection vulnerabilities occur when user-input is dynamically embedded on a page where AngularJS client-side templating is used.  By using curly braces it's possible to inject AngularJS expressions in the AngularJS client-side template that is being used by the application.These expressions will be evaluated on the client-side by AngularJS and when combined with a sandbox escape they allow an attacker to execute arbitrary JavaScript code. \n\n\n\n##### Attack Details\nURL encoded POST input **firstName** was set to **qekbbsjjrhp8w{{1==1}}hzh6w**.\nThe input was reflected inside an AngularJS template.\n \n\n##### HTTP Request\n\tPOST /contact HTTP/1.1\r\n\tContent-Length: 107\r\n\tContent-Type: application/x-www-form-urlencoded\r\n\tReferer: http://testhtml5.vulnweb.com/\r\n\tHost: testhtml5.vulnweb.com\r\n\tConnection: Keep-alive\r\n\tAccept-Encoding: gzip,deflate\r\n\tUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21\r\n\tAccept: */*\r\n\t\r\n\taddress=3137%20Laguna%20Street&firstName=qekbbsjjrhp8w{{1==1}}hzh6w&lastName=vlgxcdgy&message=20&subject=na\n\n##### Impact\nAn attacker can inject AngularJS expressions that will be evaluated on the client-side. Normally AngularJS expressions are not very dangerous, but when combined with a sandbox escape they allow an attacker to execute arbitrary JavaScript code.\n\n##### Remediation\nIt should not be possible for an attacker to inject AngularJS expressions by using curly braces. The application needs to either treat curly braces in user input as highly dangerous or avoid server-side reflection of user input entirely.\n\n----\n\n##### References:\n[AngularJS security features and best practices](https://docs.angularjs.org/guide/security)\n[XSS without HTML: Client-Side Template Injection with AngularJS](http://blog.portswigger.net/2016/01/xss-without-html-client-side-template.html)\n\n"}}
{"actor":{"display_login":"jdbacx"}}