N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-45q2-gjvg-7973

GHSA-45q2-gjvg-7973: Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server

Impact

A Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server due to improper handling of URLs during Server-Side Rendering (SSR).

When an attacker sends a request such as GET /\evil.com/ HTTP/1.1 the server engine (Express, etc.) passes the URL string to Angular’s rendering functions.

Because the URL parser normalizes the backslash to a forward slash for HTTP/HTTPS schemes, the internal state of the application is hijacked to believe the current origin is evil.com. This misinterpretation tricks the application into treating the attacker’s domain as the local origin. Consequently, any relative HttpClient requests or PlatformLocation.hostname references are redirected to the attacker controlled server, potentially exposing internal APIs or metadata services.

Affected APIs:

renderModule
renderApplication
CommonEngine (from @angular/ssr)

Non-Affected APIs:

AngularAppEngine (from @angular/ssr)
AngularNodeAppEngine (from @angular/ssr)

Attack Preconditions

The server has outbound network access.
The application uses Angular SSR via the affected APIs.
A pathname is passed as URL to the rendering method (e.g. using req.url).
The server-side code performs HTTP requests using HttpClient with relative URLs or uses PlatformLocation.hostname to build URLs.

Patches

22.0.0-next.8
21.2.9
20.3.19
19.2.21

Workarounds

Developers should implement a middleware to sanitize the request URL before it reaches Angular. This involves stripping or normalizing leading slashes:

app.use((req, res, next) => {
  // Sanitize the URL to ensure it starts with a single forward slash
  if (req.url.startsWith('//') || req.url.startsWith('/\\') || req.url.startsWith('\\')) {
     req.url = '/' + req.url.replace(/^[/\\]+/, '');
  }
  next();
});

References

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-45q2-gjvg-7973

GHSA-45q2-gjvg-7973:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@angular/platform-server	npm	>= 22.0.0-next.0, < 22.0.0-next.8	22.0.0-next.8
@angular/platform-server	npm	>= 21.0.0-next.0, < 21.2.9	21.2.9
@angular/platform-server	npm	>= 20.0.0-next.0, < 20.3.19	20.3.19
@angular/platform-server	npm	>= 19.0.0-next.0, < 19.2.21	19.2.21
@angular/platform-server	npm	<= 18.2.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) within Angular's @angular/platform-server package, caused by improper URL parsing during Server-Side Rendering (SSR). The root cause lies in the internal parseUrl function in packages/platform-server/src/location.ts. The original implementation used new URL(url, base), which, per the WHATWG specification, allows a protocol-relative URL (e.g., //evil.com) or a URL with backslashes (/\evil.com) to override the hostname of the base URL.

This flawed parseUrl function was utilized by the ServerPlatformLocation class—specifically in its constructor to process the initial request URL, and in the pushState and replaceState methods for server-side navigation. When an attacker-controlled URL (e.g., from req.url in an Express server) was passed to SSR rendering functions like renderApplication or renderModule, the ServerPlatformLocation would incorrectly adopt the attacker's domain as the application's origin.

As a result, any subsequent server-side operations using relative URLs, such as API calls via HttpClient or URL construction via PlatformLocation.hostname, would be directed to the malicious domain. This could be exploited to exfiltrate data from internal APIs or cloud metadata services.

The patch rectifies this by modifying the parseUrl function to no longer use the two-argument new URL() constructor. Instead, it manually constructs a full, absolute URL string by prepending the origin to relative paths before parsing. This ensures that attacker-controlled parts of the URL are treated as path segments rather than a new hostname, effectively neutralizing the SSRF vulnerability.

Vulnerable functions

ServerPlatformLocation

packages/platform-server/src/location.ts

The `ServerPlatformLocation` constructor processes the initial request URL provided during server-side rendering. It uses an internal `parseUrl` function that was vulnerable to hostname spoofing when given a protocol-relative or backslash-prefixed URL. This could cause subsequent relative HTTP requests on the server to be redirected to an attacker-controlled domain, leading to Server-Side Request Forgery (SSRF).

ServerPlatformLocation.pushState

packages/platform-server/src/location.ts

The `pushState` method is used for server-side navigation and takes a URL as input. It used the same vulnerable internal `parseUrl` function as the constructor, making it an entry point for the SSRF vulnerability if server-side logic can be influenced to call this method with a malicious URL.

ServerPlatformLocation.replaceState

packages/platform-server/src/location.ts

The `replaceState` method is used for server-side navigation and takes a URL as input. It used the same vulnerable internal `parseUrl` function as the constructor, making it an entry point for the SSRF vulnerability if server-side logic can be influenced to call this method with a malicious URL.

parseUrl

packages/platform-server/src/location.ts

This internal helper function contained the core vulnerability. Its use of the two-argument `new URL(url, base)` constructor allowed a protocol-relative or backslash-prefixed `urlStr` to override the hostname from the `origin`, leading to SSRF. While not directly exposed, it was called by the `ServerPlatformLocation` class methods.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.