Angular HTTP Client Flaw
CVE-2025-66035 exposes a high security flaw in Angular’s HTTP Client that allows attackers to capture Cross-Site Request Forgery (XSRF) tokens from vulnerable applications.
The vulnerability, classified as High severity with a CVSS score of 7.5, was disclosed by Angular team member Alan-Agius4 and impacts multiple versions of the @angular/standard package.
| CVE ID | Vulnerability Name | Severity | CVSS v4 Score |
|---|---|---|---|
| CVE-2025-66035 | XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client | High | 7.5 |
Angular’s HttpClient includes built-in XSRF protection designed to defend applications against cross-site request forgery attacks.
The protection mechanism works by examining request URLs to determine whether they are cross-origin or same-origin.
When the client identifies a same-origin request, it automatically appends the XSRF token to the X-XSRF-TOKEN header, allowing the backend to validate that requests originate from legitimate users.
However, the vulnerability exists in how Angular handles protocol-relative URLs—URLs that begin with two forward slashes (//) without specifying http:// or https://.
The HttpClient incorrectly treats these URLs as same-origin requests, even when they point to attacker-controlled domains.
This misclassification causes the application to leak the valid XSRF token to any domain specified in a protocol-relative URL, completely undermining XSRF protection mechanisms.
An attacker can exploit this flaw through a multi-step attack. First, the attacker must trick a vulnerable Angular application into sending a state-changing HTTP request (e.g., POST, PUT, or DELETE) to a protocol-relative URL pointing to the attacker’s infrastructure.
When the application processes this malicious request, it automatically includes the user’s valid XSRF token in the request headers.
The attacker captures this leaked token and subsequently performs unauthorized CSRF attacks against the victim’s active session, potentially modifying data or performing sensitive operations without the user’s knowledge.
Affected Systems
The vulnerability impacts multiple Angular versions:
Google has released patched versions addressing the vulnerability. Developers should immediately upgrade to version 21.0.1, 20.3.14, or 19.2.16, depending on their current Angular version.
Users of Angular 18 face a more challenging situation, as no patch has been provided for the legacy version.
As a temporary workaround, developers should avoid using protocol-relative URLs in HttpClient requests.
All backend communication URLs should be hardcoded as relative paths (beginning with a single forward slash) or fully qualified absolute URLs with explicit protocols.
This practice prevents the protocol-relative URL bypass and ensures XSRF protection functions as intended.
Organizations using Angular should prioritize patching immediately, especially applications that handle sensitive user data or financial transactions.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…