Angular Expressions - Remote Code Execution
### Impact
The vulnerability, reported by GoSecure Inc, allows Remote Code Execution, if you call `expressions.compile(userControlledInput)` where `userControlledInput` is text that comes from user input.
This time, the security of the package could be bypassed by using a more complex payload, using a `.constructor.constructor` technique.
* If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput).
* If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution.
### Patches
Users should upgrade to version 1.1.2 of angular-expressions
### Workarounds
A temporary workaround might be either to :
* disable user-controlled input that will be fed into angular-expressions in your application
OR
* allow only following characters in the userControlledInput :
```js
if (/^[|a-zA-Z.0-9 :"'+-?]+$/.test(userControlledInput)) {
var result = expressions.compile(userControlledInput);
}
else {
result = undefined;
}
```
### References
Removal of angular-expression sandbox
http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html
### For more information
If you have any questions or comments about this advisory:
* Open an issue in angular-expressions
https://github.com/peerigon/angular-expressions/issues
* [Email us](mailto:contact@javascript-ninja.fr)
### Credits
The issue was reported by Maxime Nadeau from GoSecure, Inc.