CVE-2024-8372: AngularJS XSS Vulnerability via Srcset

CVE-2024-8372 Overview

CVE-2024-8372 affects AngularJS versions 1.3.0-rc.4 and later. The framework fails to properly sanitize the value of the srcset attribute in HTML <img> and <source> elements. Attackers can bypass image source restrictions enforced by the framework's built-in sanitizer. This bypass enables content spoofing attacks, where malicious images or resources load from attacker-controlled origins under the guise of trusted application content.

AngularJS reached End-of-Life status and will not receive updates. Downstream products bundling AngularJS, including NetApp Active IQ Unified Manager, inherit the flaw and require vendor-specific remediation.

Critical Impact
User interaction can trigger loading of untrusted image resources, enabling content spoofing attacks that manipulate application appearance and trust indicators.

Affected Products

AngularJS versions 1.3.0-rc.4 and greater (End-of-Life)
NetApp Active IQ Unified Manager for Linux, VMware vSphere, and Windows
Downstream Debian LTS packages bundling AngularJS

Discovery Timeline

2024-09-09 - CVE-2024-8372 published to the National Vulnerability Database
2024-11-22 - NetApp publishes security advisory NTAP-20241122-0002
2025-07 - Debian LTS announcement issued for downstream packages
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8372

Vulnerability Analysis

AngularJS applies context-aware sanitization to attributes that reference external resources. The framework restricts URLs in attributes such as src and href using the $sce (Strict Contextual Escaping) and URL allowlist mechanisms. The srcset attribute, introduced to support responsive images, accepts a comma-separated list of URLs with descriptors. AngularJS did not extend its URL sanitization logic to parse and validate each candidate URL within a srcset value.

The flaw is classified as [CWE-1289] Improper Validation of Unsafe Equivalence in Input. An attacker who controls a bound expression rendered into a srcset attribute can supply URLs pointing to arbitrary origins. The browser then fetches and displays these resources despite AngularJS's expectation that image sources are restricted to trusted domains.

Root Cause

The sanitizer treats the srcset attribute value as an opaque string rather than parsing its comma-separated candidate list. Individual URLs inside the value bypass the same allowlist checks applied to src. This inconsistency in attribute handling is the direct root cause.

Attack Vector

Exploitation requires an application that binds untrusted input to a srcset attribute and requires the victim to load the affected page. The attacker supplies a crafted srcset value referencing an external origin. The rendered page loads the attacker-controlled image, enabling content spoofing scenarios such as fake banners, forged branding, or misleading UI elements. Impact is limited to integrity of displayed content; the flaw does not by itself provide code execution or confidentiality loss.

A proof-of-concept demonstration is hosted on CodePen by HeroDevs, illustrating the sanitizer bypass through a live example.

Detection Methods for CVE-2024-8372

Indicators of Compromise

Unexpected outbound image requests from browsers loading AngularJS applications to domains outside the organization's allowlist.
Anomalous srcset attribute values in server-rendered or dynamically generated AngularJS templates containing external URLs.
User reports of unexpected imagery, logos, or visual elements rendered inside trusted application pages.

Detection Strategies

Inventory web applications for AngularJS bundles at version 1.3.0-rc.4 or later using software composition analysis tooling.
Audit AngularJS templates for interpolation expressions bound to srcset, ng-srcset, or dynamically constructed image attributes.
Deploy Content Security Policy (CSP) reporting with an img-src directive to surface unauthorized image origins loaded by production applications.

Monitoring Recommendations

Log and review browser CSP violation reports for img-src violations correlated with AngularJS application paths.
Monitor web proxy and DNS telemetry for image fetches from unapproved external domains during user sessions.
Track vendor advisories for bundled AngularJS products, particularly the NetApp Security Advisory NTAP-20241122-0002.

How to Mitigate CVE-2024-8372

Immediate Actions Required

Migrate away from AngularJS. The project is End-of-Life and will not receive an official upstream patch.
Apply vendor-specific patches for bundled products, including NetApp Active IQ Unified Manager per NTAP-20241122-0002.
Update Debian LTS systems per the Debian LTS Announcement covering AngularJS packages.
Review application code to remove or strictly validate any binding of untrusted input to srcset attributes.

Patch Information

The upstream AngularJS project will not release a fix because it reached End-of-Life. Organizations requiring continued support should evaluate the HeroDevs CVE-2024-8372 Listing for extended support offerings, or migrate to a supported framework such as Angular. Downstream distributors, including NetApp and Debian LTS, have shipped fixes in their respective advisories.

Workarounds

Enforce a restrictive Content Security Policy with img-src limited to trusted origins to block unauthorized image loads.
Strip or reject user-supplied srcset values in server-side input validation before rendering.
Replace dynamic srcset bindings with server-computed, allowlisted URL sets that do not incorporate untrusted input.

bash

# Example CSP header restricting image sources to the application origin and a trusted CDN
Content-Security-Policy: default-src 'self'; img-src 'self' https://cdn.example.com; report-uri /csp-report