CVE-2025-62427

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-62427", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-13T16:26:12.180Z", "datePublished": "2025-10-16T18:50:11.598Z", "dateUpdated": "2025-10-17T13:24:15.389Z"}, "containers": {"cna": {"title": "Server-Side Request Forgery (SSRF) in Angular SSR", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/angular/angular-cli/security/advisories/GHSA-q63q-pgmf-mxhr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/angular/angular-cli/security/advisories/GHSA-q63q-pgmf-mxhr"}, {"name": "https://github.com/angular/angular-cli/commit/5271547c80662de10cb3bcb648779a83f6efedfb", "tags": ["x_refsource_MISC"], "url": "https://github.com/angular/angular-cli/commit/5271547c80662de10cb3bcb648779a83f6efedfb"}], "affected": [{"vendor": "angular", "product": "angular-cli", "versions": [{"version": ">=19.0.0-next.0, < 19.2.18", "status": "affected"}, {"version": ">=20.0.0-next.0, < 20.3.6", "status": "affected"}, {"version": ">=21.0.0-next.0, < 21.0.0-next.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-17T13:24:15.389Z"}, "descriptions": [{"lang": "en", "value": "The Angular SSR is a server-rise rendering tool for Angular applications. The vulnerability is a Server-Side Request Forgery (SSRF) flaw within the URL resolution mechanism of Angular's Server-Side Rendering package (@angular/ssr) before 19.2.18, 20.3.6, and 21.0.0-next.8. The function createRequestUrl uses the native URL constructor. When an incoming request path (e.g., originalUrl or url) begins with a double forward slash (//) or backslash (\\\\), the URL constructor treats it as a schema-relative URL. This behavior overrides the security-intended base URL (protocol, host, and port) supplied as the second argument, instead resolving the URL against the scheme of the base URL but adopting the attacker-controlled hostname. This allows an attacker to specify an external domain in the URL path, tricking the Angular SSR environment into setting the page's virtual location (accessible via DOCUMENT or PlatformLocation tokens) to this attacker-controlled domain. Any subsequent relative HTTP requests made during the SSR process (e.g., using HttpClient.get('assets/data.json')) will be incorrectly resolved against the attacker's domain, forcing the server to communicate with an arbitrary external endpoint. This vulnerability is fixed in 19.2.18, 20.3.6, and 21.0.0-next.8."}], "source": {"advisory": "GHSA-q63q-pgmf-mxhr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-16T19:33:05.989848Z", "id": "CVE-2025-62427", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-16T19:33:28.924Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62427", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-16T19:33:05.989848Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-16T19:33:10.956Z"}}], "cna": {"title": "Server-Side Request Forgery (SSRF) in Angular SSR", "source": {"advisory": "GHSA-q63q-pgmf-mxhr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "angular", "product": "angular-cli", "versions": [{"status": "affected", "version": ">=19.0.0-next.0, < 19.2.18"}, {"status": "affected", "version": ">=20.0.0-next.0, < 20.3.6"}, {"status": "affected", "version": ">=21.0.0-next.0, < 21.0.0-next.8"}]}], "references": [{"url": "https://github.com/angular/angular-cli/security/advisories/GHSA-q63q-pgmf-mxhr", "name": "https://github.com/angular/angular-cli/security/advisories/GHSA-q63q-pgmf-mxhr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/angular/angular-cli/commit/5271547c80662de10cb3bcb648779a83f6efedfb", "name": "https://github.com/angular/angular-cli/commit/5271547c80662de10cb3bcb648779a83f6efedfb", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The Angular CLI is a command-line interface tool for Angular applications. The vulnerability is a Server-Side Request Forgery (SSRF) flaw within the URL resolution mechanism of Angular's Server-Side Rendering package (@angular/ssr) before 19.2.18, 20.3.6, and 21.0.0-next.8. The function createRequestUrl uses the native URL constructor. When an incoming request path (e.g., originalUrl or url) begins with a double forward slash (//) or backslash (\\\\), the URL constructor treats it as a schema-relative URL. This behavior overrides the security-intended base URL (protocol, host, and port) supplied as the second argument, instead resolving the URL against the scheme of the base URL but adopting the attacker-controlled hostname. This allows an attacker to specify an external domain in the URL path, tricking the Angular SSR environment into setting the page's virtual location (accessible via DOCUMENT or PlatformLocation tokens) to this attacker-controlled domain. Any subsequent relative HTTP requests made during the SSR process (e.g., using HttpClient.get('assets/data.json')) will be incorrectly resolved against the attacker's domain, forcing the server to communicate with an arbitrary external endpoint. This vulnerability is fixed in 19.2.18, 20.3.6, and 21.0.0-next.8."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-16T18:50:11.598Z"}}}, "cveMetadata": {"cveId": "CVE-2025-62427", "state": "PUBLISHED", "dateUpdated": "2025-10-16T19:33:28.924Z", "dateReserved": "2025-10-13T16:26:12.180Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-16T18:50:11.598Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "angular-cli", "vendor": "angular", "versions": [{"status": "affected", "version": ">=19.0.0-next.0, < 19.2.18"}, {"status": "affected", "version": ">=20.0.0-next.0, < 20.3.6"}, {"status": "affected", "version": ">=21.0.0-next.0, < 21.0.0-next.8"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Angular SSR is a server-rise rendering tool for Angular applications. The vulnerability is a Server-Side Request Forgery (SSRF) flaw within the URL resolution mechanism of Angular's Server-Side Rendering package (@angular/ssr) before 19.2.18, 20.3.6, and 21.0.0-next.8. The function createRequestUrl uses the native URL constructor. When an incoming request path (e.g., originalUrl or url) begins with a double forward slash (//) or backslash (\\\\), the URL constructor treats it as a schema-relative URL. This behavior overrides the security-intended base URL (protocol, host, and port) supplied as the second argument, instead resolving the URL against the scheme of the base URL but adopting the attacker-controlled hostname. This allows an attacker to specify an external domain in the URL path, tricking the Angular SSR environment into setting the page's virtual location (accessible via DOCUMENT or PlatformLocation tokens) to this attacker-controlled domain. Any subsequent relative HTTP requests made during the SSR process (e.g., using HttpClient.get('assets/data.json')) will be incorrectly resolved against the attacker's domain, forcing the server to communicate with an arbitrary external endpoint. This vulnerability is fixed in 19.2.18, 20.3.6, and 21.0.0-next.8."}, {"lang": "es", "value": "El SSR de Angular es una herramienta de renderizado del lado del servidor para aplicaciones Angular. La vulnerabilidad es un fallo de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) dentro del mecanismo de resoluci\u00f3n de URL del paquete de renderizado del lado del servidor de Angular (@angular/ssr) anterior a las versiones 19.2.18, 20.3.6 y 21.0.0-next.8. La funci\u00f3n createRequestUrl utiliza el constructor de URL nativo. Cuando una ruta de petici\u00f3n entrante (por ejemplo, originalUrl o url) comienza con una doble barra diagonal (//) o una barra invertida (\\\\), el constructor de URL la trata como una URL relativa al esquema. Este comportamiento anula la URL base prevista para la seguridad (protocolo, host y puerto) suministrada como segundo argumento, resolviendo en su lugar la URL contra el esquema de la URL base pero adoptando el nombre de host controlado por el atacante. Esto permite a un atacante especificar un dominio externo en la ruta de la URL, enga\u00f1ando al entorno SSR de Angular para que establezca la ubicaci\u00f3n virtual de la p\u00e1gina (accesible a trav\u00e9s de los tokens DOCUMENT o PlatformLocation) a este dominio controlado por el atacante. Cualquier petici\u00f3n HTTP relativa subsiguiente realizada durante el proceso SSR (por ejemplo, usando HttpClient.get('assets/data.json')) se resolver\u00e1 incorrectamente contra el dominio del atacante, forzando al servidor a comunicarse con un punto final externo arbitrario. Esta vulnerabilidad est\u00e1 corregida en las versiones 19.2.18, 20.3.6 y 21.0.0-next.8."}], "id": "CVE-2025-62427", "lastModified": "2026-10-09T10:10:00.193", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62427", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-16T19:33:05.989848Z", "version": "2.0.3"}}]}, "published": "2025-10-16T19:15:35.293", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/angular/angular-cli/commit/5271547c80662de10cb3bcb648779a83f6efedfb"}, {"source": "security-advisories@github.com", "url": "https://github.com/angular/angular-cli/security/advisories/GHSA-q63q-pgmf-mxhr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-20T13:24:55.978292+00:00", "updated": "2025-10-20T13:24:55.978322+00:00", "vendors": ["angular", "angular$PRODUCT$angular"]}