Summary of the Vulnerability
- Application: Internal Knowledge App (FAQ page)
- Library: AngularJS v1.8.3 (legacy, vulnerable)
- Exploit: AngularJS payload injection leading to XSS (Cross-Site Scripting)
- Payload Used:
Interactivity on code previews is coming soon{{constructor.constructor('alert(document.location)')()}}Show more lines
- Risk Rating: HIGH
- CVSSv3 Score: 7.0
- MITRE ATT&CK ID: T1595.002 – Active Scanning
Impact:
This vulnerability allows attackers to inject malicious JavaScript payloads via the AngularJS template, leading to potential account compromise, data leakage, or further lateral movement within the internal network.
Recommendation:
- Upgrade AngularJS to a supported, non-vulnerable version, or migrate to a modern framework.
- Implement input sanitization and strict Content Security Policy (CSP).
- Audit all usages of AngularJS expressions and user-supplied input in templates.
References:
Risk Level: High - Immediate action recommended.
Summary of the Vulnerability
Impact:
This vulnerability allows attackers to inject malicious JavaScript payloads via the AngularJS template, leading to potential account compromise, data leakage, or further lateral movement within the internal network.
Recommendation:
References:
Risk Level: High - Immediate action recommended.