SecBoard
Zurück zur CVE-Übersicht

CVE-2026-104871

NONE
Risk Signal Score0/100 — NIEDRIG

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.4%

Exploit-Wahrscheinlichkeit (30 Tage)

Beschreibung

The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. The non-special resolve:// URL base preserves the backslash, path.join interprets it as a Windows separator, and the pagePath.startsWith(normalize(publicPath)) check incorrectly accepts a sibling output directory whose name shares the configured public-directory prefix. An unauthenticated requester can therefore retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker. The issue is limited to Windows deployments that pass relative request URLs to CommonEngine.render, have a prefix-sharing sibling output directory, and contain qualifying prerendered Angular HTML; it does not provide arbitrary file read. This issue is fixed in versions 20.3.36, 21.2.23, and 22.1.7.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 20.3.36
  • 21.2.23
  • 22.1.7

Threat-Hunting-Queries

Detects attempts to access files outside the intended public directory using path traversal techniques, specifically looking for backslashes in URLs on Windows systems.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "node.exe"
| where ProcessCommandLine contains "@angular/ssr"
| where ProcessCommandLine contains "retrieveSSGPage"
| where ProcessCommandLine contains "..\\" or ProcessCommandLine contains "../"
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName, FolderPath

Splunk SPL

index=* sourcetype=process_events (process_name="node.exe" OR process_name="node") (command_line="*@angular/ssr*" AND command_line="*retrieveSSGPage*" AND (command_line="*..\\*" OR command_line="*../*")) | table _time, host, process_name, command_line

Sigma

title: Angular SSR Path Traversal Attempt
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\node.exe'
    CommandLine|contains:
      - '@angular/ssr'
      - 'retrieveSSGPage'
    CommandLine|contains:
      - '..\\'
      - '../'
  condition: selection
fields:
  - CommandLine
  - Image
  - ParentCommandLine
level: medium

Elastic ES|QL

FROM process WHERE process.executable.name : ("node.exe", "node") AND process.command_line : "*@angular/ssr*" AND process.command_line : "*retrieveSSGPage*" AND (process.command_line : "*..\\*" OR process.command_line : "*../*")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Datei-Hashes (4)

  • 645e41a47d21b7651837a4250de99af0509626e2
  • 70748ca8e76fe4b42798719410336119d943e755
  • bb72145f9ab45aee29f523236b3a25cd0813a841
  • c3e5982e49705f0f6a913cb94622b4c555d2d914

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

GitHub Advisories

GHSA-7g7c-h8rr-7p6qMEDIUM

Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

npm/@angular/ssr→ 22.1.7
GitHub Advisory

Referenzen