Cloudanix VulnDB

CVE-2025-2336

Medium · 4.8

CVSS

4.8

EPSS

0.3%

Published

Jun 4, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in an older web framework component lets attackers slip in misleading pictures that can confuse users or slow down the application, and no fixes will be released because the framework is no longer supported.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Data Tampering
Component
Web Framework
Class
Improper Input Validation
Remediation
No Fix Yet
Effort
Other
Patch risk
Other

What it actually does

Improper sanitization of 'href' and 'xlink:href' attributes on <image> SVG elements in ngSanitize permits bypass of image source restrictions, enabling content spoofing and resource exhaustion via oversized or slow-loading images.

Why it matters to the business

Applications may display misleading content or suffer degraded performance and availability; the affected component reached end-of-life with no patches available, increasing long-term exposure for any dependent systems.

How an attack unfolds

An attacker supplies a crafted SVG containing an <image> element whose href or xlink:href attribute evades ngSanitize filters, causing the application to fetch attacker-controlled or resource-intensive images.

How to fix it

Migrate away from the end-of-life AngularJS framework; where dotnet6 on Ubuntu 22.04 LTS is in use, upgrade to version 6.0.109-0ubuntu1~22.04.1 or later.

How to confirm the fix worked

Inventory all applications for AngularJS versions >= 1.3.1 and confirm removal or replacement; verify dotnet6 package version on Ubuntu 22.04 LTS matches or exceeds the listed fixed release.

Typical attack path

  1. Identify an AngularJS application using ngSanitize on versions >= 1.3.1
  2. Craft an SVG payload embedding a malicious or oversized image reference
  3. Inject the SVG into user-controlled content that passes through the sanitizer
  4. Trigger rendering to achieve content spoofing or performance impact

How to detect it

Search application logs and web request records for SVG uploads or renders containing image elements with external or data-URI href values; review client-side rendering paths for unexpected image loads after sanitizer processing.

What your security team should do

  • Prioritize migration off AngularJS due to end-of-life status and lack of updates
  • Apply the specified dotnet6 package update on Ubuntu 22.04 LTS systems
  • Review content-handling code for reliance on ngSanitize and implement additional server-side image validation
  • Monitor EPSS and exploit maturity indicators for any future changes

The record

Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing  and also negatively affect the application's performance and behavior by using too large or slow-to-load images. This issue affects AngularJS versions greater than or equal to 1.3.1. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .

Affected packages

Ecosystem Package Introduced Fixed
npm angular-sanitize 1.3.1 No fix
Debian:11 angular.js 0 No fix
Debian:12 angular.js 0 No fix
Debian:13 angular.js 0 No fix

Related vulnerabilities