1.2 KiB
1.2 KiB
Security vulnerability details for angular-jwt < 0.1.10
Domain whitelisting bypass
Description
The domain whitelisting feature can be bypassed. For example, if the setting is initialized with
jwtInterceptorProvider.whiteListedDomains = ['whitelisted.Example.com'];
An attacker can set up a domain whitelistedXexample.com that will pass the whitelist filter. The root cause for this is that angular-jwt always treats whiteListedDomains entries as regular expressions and causes . separator to match any character.
Mitigation
Updated package is available on NPM:
$ npm install angular-jwt@0.1.10
To make it easier to keep up with security updates in the future, please make sure your package.json file is updated to take patch and minor level updates of our libraries:
{
"dependencies": {
"angular-jwt": "^0.1.10"
}
}
Upgrade notes
- This fix patches your application but has no impact on your data or user sessions.
References
Credits
- Stephan Hauser