Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing a popping dot segment followed by multiple slashes can bypass the raw resolveUrl check and normalize to a pathname beginning with two slashes. When Angular SSR detects a mismatch with the router's final location, it can place that pathname in an HTTP Location header, causing a browser to navigate to an attacker-controlled origin. Affected applications use @angular/platform-server and @angular/ssr and either expose compatible parameter or child route shapes or pass user-controlled navigation targets through infrastructure that preserves the relevant dot segments or semicolons. Pure client-side SPAs are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.

Etkilenen sürümler1 yazılım

Kaynaklar13 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…ngular/security/advisories/GHSA-w739-gvwx-grc3 Diğer
• github.com/angular/angular/issues/71076 Diğer
• github.com/angular/angular/pull/71077 Diğer
• github.com/angular/angular/pull/71078 Diğer
• github.com/angular/angular/pull/71079 Diğer
• github.com/…ommit/450af9c813c7660b9bd91e5635f705ee3ed7b32a Diğer
• github.com/…ommit/83944fc8c50e86be90e8ec4184cd15002b5af262 Diğer
• github.com/…ommit/928dcfd2582152655b5559509d057bf6a5a19521 Diğer
• github.com/angular/angular/releases/tag/v20.3.33 Diğer
• github.com/angular/angular/releases/tag/v21.2.25 Diğer
• github.com/angular/angular/releases/tag/v22.2.1 Diğer

Kayıt geçmişi

1. 3 Kas 2026 23:55Yayımlandı

İlgili açıklar

• 8,2 CVE-2026-111751Angular RouterLink sorgu parametresi tutma nedeniyle SSR'de hizmet reddi (DoS)
• 8,2 CVE-2026-111752Angular Router SSR ortamında eşleşmeyen boş yollu çıkış rotaları nedeniyle hizmet reddi (DoS)
• 3,4 CVE-2026-116376Multiple vulnerabilities that affects IBM Db2 Genius Hub
• 6,1 CVE-2026-122132go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware
• 5,3 CVE-2026-121373Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)
• 5,1 CVE-2026-11753A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is…