@angular/ssr: Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

A Path Traversal vulnerability exists in the prerendered (SSG) page retrieval logic of CommonEngine in @angular/ssr/node (and @angular/ssr in earlier versions). When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serve prerendered pages from sibling output directories.

The vulnerability occurs due to how relative URLs and Windows file paths are resolved and validated:

1. A request URL containing a backslash parent traversal segment (e.g., /..\app-admin) is passed to CommonEngine.render({ url }).
2. The engine parses the URL using new URL(url, 'resolve://'). Because resolve:// is a non-special scheme under the WHATWG URL standard, backslashes are not normalized to forward slashes, leaving the pathname unnormalized as /..\app-admin.
3. The engine constructs the candidate file path using join(publicPath, pathname, 'index.html'). On Windows, path.join treats \ as a path delimiter, resolving the parent segment (..\) out of publicPath (e.g., dist\app) into a sibling directory (e.g., dist\app-admin\index.html).
4. The containment check (pagePath.startsWith(normalize(publicPath))) performs a prefix match without a trailing path delimiter. Because the sibling folder name starts with the configured public folder name (e.g., dist\app-admin starts with dist\app), the check erroneously succeeds.
5. If the target file exists and contains the Angular SSG marker (ng-server-context="...ssg..."), CommonEngine reads and serves the sibling page instead of rendering the requested route.

Impact

This vulnerability allows unauthorized access to prerendered static pages from adjacent applications or build outputs:

• Information Disclosure: Prerendered HTML pages located in sibling directories sharing the same name prefix as the public directory (e.g., an internal administration app app-admin adjacent to app) can be accessed by unauthorized users.
• Limited Scope: Only HTML files matching the Angular SSG marker regex are served. Arbitrary non-Angular files, secrets, or configuration files without the SSG context attribute cannot be read through this mechanism.

Attack Preconditions

• The application must use CommonEngine from @angular/ssr/node (or @angular/ssr in v17–v18).
• The application must be hosted on Windows (where Node's path.join resolves \ as a path separator).
• The application passes a relative request URL (such as req.url or req.originalUrl without origin) into CommonEngine.render({ url }).
• A sibling directory exists whose name starts with the same prefix as the configured publicPath directory (e.g., dist\app-admin alongside dist\app).
• The targeted sibling directory contains prerendered HTML output containing the Angular SSG marker.

Affected Versions

• >= 22.0.0, < 22.1.7
• >= 21.0.0, < 21.2.23
• >= 20.0.0, < 20.3.36
• <= 19.2.27

Patches

• 22.1.7
• 21.2.23
• 20.3.36

> Versions <= 19.2.27 have reached End of Support / LTS expiration and will not be patched.

Workarounds

Until a patch is applied, developers using CommonEngine on Windows can sanitize request URLs in server.ts before passing them to CommonEngine.render, ensuring backslashes are replaced or that an absolute HTTP URL is constructed:

server.use((req, res, next) => {
  const { protocol, originalUrl, headers } = req;

  // Normalize backslashes or construct a full HTTP URL (which forces WHATWG URL normalization)
  const sanitizedUrl = `${protocol}://${headers.host}${originalUrl.replace(/\\/g, '/')}`;

  commonEngine
    .render({
      bootstrap,
      documentFilePath: indexHtml,
      url: sanitizedUrl,
      publicPath: distFolder,
    })
    .then((html) => res.send(html))
    .catch((err) => next(err));
});

Alternatively, migrate from the deprecated CommonEngine to AngularNodeAppEngine, which relies on manifest-based route matching rather than direct filesystem path resolution.