CVE-2024-8373

What it actually does

Improper sanitization of the srcset attribute on source HTML elements allows crafted values to bypass image source restrictions and enable content spoofing.

Why it matters to the business

Applications built on AngularJS can be tricked into displaying attacker-controlled content, eroding user trust and potentially aiding phishing or misinformation; because the framework is end-of-life, organizations must migrate or accept permanent exposure.

How an attack unfolds

An attacker supplies a malicious srcset value inside a source element that AngularJS renders without proper filtering, causing the browser to load attacker-chosen resources and thereby spoof image content or bypass CSP-style image restrictions.

How to fix it

Migrate away from AngularJS to a supported framework such as Angular; until migration is complete, add server-side or client-side sanitization that strips or validates srcset values on source elements.

How to confirm the fix worked

Audit the application for any remaining AngularJS usage and test picture/img elements to confirm that arbitrary srcset values are rejected or escaped.

Typical attack path

1. Locate a web page rendered by AngularJS that includes img or picture elements
2. Inject or supply a crafted srcset attribute on a source element
3. Bypass existing image-source allow-lists or sanitizers
4. Cause the browser to fetch and display attacker-controlled content

How to detect it

Search web-server and application logs for unexpected or encoded values appearing in srcset attributes on source tags; review rendered HTML for picture elements that contain non-whitelisted image sources.

What your security team should do

• Prioritize migration off AngularJS within the next quarter
• Implement additional input sanitization around srcset attributes as a temporary control
• Review content-security-policy directives to limit image sources
• Monitor for any downstream libraries still depending on AngularJS