Outdated AngularJS Library Can Be Used to Slow Down Your App

Vulnerability Explanation

The AngularJS `$resource` service uses a regular expression to process URL templates that contains an inefficient, potentially exponential worst-case complexity pattern (CWE-1333). When a URL containing a large number of consecutive slashes followed by a non-slash character is passed to `$resource`, the regex engine enters catastrophic backtracking, consuming excessive CPU cycles. An attacker who can influence the URL parameter passed to `$resource` — for example, through a user-controlled route or query parameter — can trigger this condition remotely with no authentication required. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects network-reachable exploitation with no privileges needed, but with only low availability impact.

Root Cause

The root cause is an insufficiently constrained regular expression in the AngularJS `$resource` URL parser. The regex uses a pattern susceptible to catastrophic backtracking when processing pathological inputs with repeated slash characters. Because AngularJS reached end-of-life on December 31, 2021, no upstream patch has been released for the open-source version.

Technical Impact

An attacker can cause the JavaScript event loop (Node.js server-side rendering) or the browser's main thread to stall for an extended period, resulting in denial of service for other users. There is no confidentiality or integrity impact — this is a pure availability issue. Exploitation requires the ability to supply a crafted URL string to a `$resource` call.

Severity Justification

CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Impact is limited to availability (low), with no data exposure or integrity risk. EPSS exploitation probability is approximately 0.27%, indicating low real-world exploitation activity.

Affected Components

• angular (npm) >= 1.0.0, <= 1.8.3

Remediation Steps

1. Audit your codebase to identify all uses of AngularJS's `$resource` service and whether URL parameters can be influenced by user input. If `$resource` is not used, risk is negligible.
2. Preferred long-term fix: migrate to a modern, actively maintained framework (Angular 17+, React, Vue). AngularJS is EOL and will not receive free upstream patches.
3. Short-term mitigation if migration is not immediately feasible: validate and sanitize all URL strings passed to `$resource` to reject inputs containing sequences of more than a few consecutive slashes (e.g., enforce a regex like `/^[^/]*(/[^/]+)*$/` on inputs before passing them to `$resource`).
4. If you require a patched drop-in version of AngularJS, evaluate HeroDevs NES for AngularJS (versions 1.9.1+ and 1.5.17+ contain a fix for this CVE) as a commercial extended support option.
5. Add server-side rate limiting on endpoints that accept user-supplied URL parameters to reduce the impact of any attempted ReDoS attack.

Verification Steps

1. Search your codebase for `$resource` usage: `grep -r '\$resource' src/` — review each call site to determine if the URL argument can be user-influenced.
2. If using npm, confirm the installed version: `npm list angular` — it should not show a version <= 1.8.3.
3. Test the fix by passing a crafted URL with many consecutive slashes (e.g., `/api///////foo`) to any `$resource` call and confirm the application does not hang or spike CPU.

Code Examples (javascript)

// User-controlled input passed directly to $resource
const userPath = req.query.path; // e.g. '/api///////foo'
const Resource = $resource(userPath);
Resource.query();

// Validate input before use — reject paths with consecutive slashes
const userPath = req.query.path;
const safePathPattern = /^\/([a-zA-Z0-9_\-]+\/)*([a-zA-Z0-9_\-]+)?$/;
if (!safePathPattern.test(userPath)) {
  throw new Error('Invalid path parameter');
}
const Resource = $resource(userPath);
Resource.query();

Best Practices

• Never pass unsanitized user input directly into URL template strings used by HTTP client libraries.
• Establish a dependency review process to flag end-of-life libraries — EOL packages will accumulate CVEs with no free upstream remediation.
• Implement server-side rate limiting and request timeout policies to bound the impact of any CPU-exhaustion attack.

References

• security.snyk.io/vuln/SNYK-JS-ANGULAR-3373045
• github.com/advisories/GHSA-2qqx-w9hr-q5gx
• www.herodevs.com/vulnerability-directory/cve-2023-26117
• stackblitz.com/edit/angularjs-vulnerability-resource-trailing-slashes-redos