{"id":"CVE-2025-62427","sourceIdentifier":"security-advisories@github.com","published":"2025-10-16T19:15:35.293","lastModified":"2026-10-09T10:10:00.193","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Angular SSR is a server-rise rendering tool for Angular applications. The vulnerability is a Server-Side Request Forgery (SSRF) flaw within the URL resolution mechanism of Angular's Server-Side Rendering package (@angular/ssr) before 19.2.18, 20.3.6, and 21.0.0-next.8. The function createRequestUrl uses the native URL constructor. When an incoming request path (e.g., originalUrl or url) begins with a double forward slash (//) or backslash (\\\\), the URL constructor treats it as a schema-relative URL. This behavior overrides the security-intended base URL (protocol, host, and port) supplied as the second argument, instead resolving the URL against the scheme of the base URL but adopting the attacker-controlled hostname. This allows an attacker to specify an external domain in the URL path, tricking the Angular SSR environment into setting the page's virtual location (accessible via DOCUMENT or PlatformLocation tokens) to this attacker-controlled domain. Any subsequent relative HTTP requests made during the SSR process (e.g., using HttpClient.get('assets/data.json')) will be incorrectly resolved against the attacker's domain, forcing the server to communicate with an arbitrary external endpoint. This vulnerability is fixed in 19.2.18, 20.3.6, and 21.0.0-next.8."},{"lang":"es","value":"El SSR de Angular es una herramienta de renderizado del lado del servidor para aplicaciones Angular. La vulnerabilidad es un fallo de falsificación de petición del lado del servidor (SSRF) dentro del mecanismo de resolución de URL del paquete de renderizado del lado del servidor de Angular (@angular/ssr) anterior a las versiones 19.2.18, 20.3.6 y 21.0.0-next.8. La función createRequestUrl utiliza el constructor de URL nativo. Cuando una ruta de petición entrante (por ejemplo, originalUrl o url) comienza con una doble barra diagonal (//) o una barra invertida (\\\\), el constructor de URL la trata como una URL relativa al esquema. Este comportamiento anula la URL base prevista para la seguridad (protocolo, host y puerto) suministrada como segundo argumento, resolviendo en su lugar la URL contra el esquema de la URL base pero adoptando el nombre de host controlado por el atacante. Esto permite a un atacante especificar un dominio externo en la ruta de la URL, engañando al entorno SSR de Angular para que establezca la ubicación virtual de la página (accesible a través de los tokens DOCUMENT o PlatformLocation) a este dominio controlado por el atacante. Cualquier petición HTTP relativa subsiguiente realizada durante el proceso SSR (por ejemplo, usando HttpClient.get('assets/data.json')) se resolverá incorrectamente contra el dominio del atacante, forzando al servidor a comunicarse con un punto final externo arbitrario. Esta vulnerabilidad está corregida en las versiones 19.2.18, 20.3.6 y 21.0.0-next.8."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"angular","product":"angular-cli","versions":[{"version":">=19.0.0-next.0, < 19.2.18","status":"affected"},{"version":">=20.0.0-next.0, < 20.3.6","status":"affected"},{"version":">=21.0.0-next.0, < 21.0.0-next.8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-10-16T19:33:05.989848Z","id":"CVE-2025-62427","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/angular/angular-cli/commit/5271547c80662de10cb3bcb648779a83f6efedfb","source":"security-advisories@github.com"},{"url":"https://github.com/angular/angular-cli/security/advisories/GHSA-q63q-pgmf-mxhr","source":"security-advisories@github.com"}]}