SecureAuth security advisory – AngularJS client-side template injection

All versions of AngularJS are susceptible to client-side template injection by utilizing a payload enclosed in “{{“ and “}}”. An attacker could execute cross-site scripting against a user through this method which could potentially expose information such as cookies or other browser information, which could then be used to further access information or services.

Within the Identity Platform, AngularJS is used in the Themes module to render login pages to unauthenticated users. These forms did perform input sanitization and validation on the server side; however, the “{{“ and “}}” were not included in previous version of the Themes module. The hotfix related to this vulnerability includes server-side input sanitization and validation for the characters used to exploit this issue.

This attack appears to be only possible if a malicious administrator created or modified a user to include attack code within the username registered in the directory store configured for the Identity Platform. For example, a susceptible username would be “user123{{constructor.constructor('alert(1)')()}}” and the malicious administrator would need to convince the end user that this username is their valid username to authentication via the Identity Platform.

The attacker could initiate a cross-site scripting attack against a user to potentially steal browser information such as authentication cookies.

All supported Identity Platform/SecureAuth IdP products (9.1, 9.2, 9.3, and 19.07) running on any version of Windows Server are vulnerable to this issue.

Identity Platform administrators can potentially minimize the impact of this vulnerability by performing the following:

Please contact SecureAuth Customer Support (support@secureauth.com) to assist in implementing the patch for the appropriate realms with the Identity Platform.