Summary
A server-side request forgery vulnerability in Angular Server-Side Rendering can redirect an apparently approved relative URL to an attacker-controlled origin. In applications that attach sensitive server-side credentials to validated requests, exploitation may disclose those credentials and expose internal services.
Affected context
The issue occurs in Angular applications using @angular/platform-server and server-side HttpClient request handling. It becomes risky when application logic performs same-origin validation with WHATWG URL parsing, while subsequent URL utilities trim leading Unicode whitespace and transform the value into a protocol-relative URL. The risk is greater when approved requests receive server-side authentication headers or other sensitive credentials.
Exploit preconditions
- Attack surface: Server-side rendering request processing through Angular
HttpClient - Required access: Ability to influence a resource or request URL consumed by the application
- Trigger point: URL normalization and dispatch after application-level same-origin validation
- Why exploitation is possible: Leading Unicode whitespace can be removed after validation, changing a previously relative URL into an attacker-controlled protocol-relative destination
- Additional exposure factor: The application attaches sensitive server-side credentials to requests considered approved
Why this happens
The underlying bug is inconsistent URL canonicalization between validation and request dispatch. The application validates one representation of a user-controlled URL, but resolveUrl and parseUrl later call String.prototype.trim(), which removes leading Unicode whitespace and changes the effective destination. This validation-versus-use mismatch maps to CWE-918: Server-Side Request Forgery, because attacker-influenced input can cause the server to initiate requests to unintended hosts.
Potential impact
- Internal services or metadata endpoints could be accessed from the server
- Authorization headers or other server-side credentials may be disclosed
- Sensitive internal response data could be returned to an attacker-controlled destination
- Network boundaries and access controls could be bypassed through the SSR process
- Server-side rendering availability or integrity could be affected
General mitigation guidance
Mitigation generally focuses on making URL validation and request dispatch use the same canonical representation and trust policy.
Common defensive patterns include:
- Normalize URLs before validation and before any security decision
- Prefer explicit URL parsing and allowlists for permitted schemes, hosts, ports, and paths
- Avoid forwarding server-side credentials to user-influenced destinations
- Use separate, least-privileged HTTP clients for server-rendered requests
- Restrict outbound network access with egress policies and segmented service accounts
- Reject ambiguous, malformed, or non-canonical URL forms by default
- Keep URL transformation utilities consistent across validation and dispatch paths
How teams detect issues like this
Organizations can detect related issues through:
- Static analysis rules identifying URL validation followed by later normalization or trimming
- Code review checks for user-controlled URLs passed to server-side HTTP clients
- Searches for credential-bearing interceptors applied to broadly approved requests
- Tests using Unicode whitespace, encoded delimiters, protocol-relative forms, and alternate URL representations
- Runtime monitoring of SSR outbound requests to unexpected hosts, ports, or network ranges
- Egress policies that alert on or block access to private, link-local, and metadata addresses
Automated code review and security scanning tools may help identify inconsistent canonicalization and SSRF-prone request flows.
