CVE-2025-66035
Full vulnerability record from the local CVENow database.
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
Severity
HIGH
CVSS score
7.7
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2025-11-26 23:15:49.550000
Last modified
2026-10-19 13:10:00.110000
View original CVE JSON
{
"id": "CVE-2025-66035",
"sourceIdentifier": "[email protected]",
"published": "2025-11-26T23:15:49.550",
"lastModified": "2026-10-19T13:10:00.110",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs."
},
{
"lang": "es",
"value": "Angular es una plataforma de desarrollo para construir aplicaciones web móviles y de escritorio usando TypeScript/JavaScript y otros lenguajes. Versiones anteriores a las 19.2.16, 20.3.14 y 21.0.1, existe una fuga de token XSRF a través de URLs relativas al protocolo en clientes HTTP de Angular. La vulnerabilidad es una fuga de credenciales por lógica de aplicación que conduce a la divulgación no autorizada del token de Cross-Site Request Forgery (XSRF) a un dominio controlado por el atacante. El HttpClient de Angular tiene un mecanismo de protección XSRF incorporado que funciona comprobando si una URL de petición comienza con un protocolo (http:// o https://) para determinar si es de origen cruzado. Si la URL comienza con una URL relativa al protocolo (//), se trata incorrectamente como una petición del mismo origen, y el token XSRF se añade automáticamente a la cabecera X-XSRF-TOKEN. Este problema ha sido parcheado en las versiones 19.2.16, 20.3.14 y 21.0.1. Una solución alternativa para este problema implica evitar el uso de URLs relativas al protocolo (URLs que comienzan con //) en las peticiones de HttpClient. Todas las URLs de comunicación de backend deben ser codificadas de forma rígida como rutas relativas (que comienzan con una sola /) o URLs absolutas de confianza y completamente calificadas."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "angular",
"product": "angular",
"versions": [
{
"version": ">= 21.0.0-next.0, < 21.0.1",
"status": "affected"
},
{
"version": ">= 20.0.0-next.0, < 20.3.14",
"status": "affected"
},
{
"version": "< 19.2.16",
"status": "affected"
}
]
}
]
},
{
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"affectedData": [
{
"vendor": "Siemens",
"product": "RUGGEDCOM RST2428P",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V4.0",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIDIS Prime",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V4.0.800",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-11-28T18:28:53.883453Z",
"id": "CVE-2025-66035",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-201"
},
{
"lang": "en",
"value": "CWE-359"
}
]
}
],
"references": [
{
"url": "https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f",
"source": "[email protected]"
},
{
"url": "https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc",
"source": "[email protected]"
},
{
"url": "https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e",
"source": "[email protected]"
},
{
"url": "https://github.com/angular/angular/releases/tag/19.2.16",
"source": "[email protected]"
},
{
"url": "https://github.com/angular/angular/releases/tag/20.3.14",
"source": "[email protected]"
},
{
"url": "https://github.com/angular/angular/releases/tag/21.0.1",
"source": "[email protected]"
},
{
"url": "https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37",
"source": "[email protected]"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-485750.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
}
]
}