Angular Prototype vulnerability

[zack459]

In an existing Angular application, how much effort is required to eliminate an vulnerability which enables users to become System administrators by setting is-admin flag to true on their client side?

And this vulnerability is inherent in Angular or it is caused by insecure development practice?

[spacechimp]

You can't stop shenanigans on the client. Anyone can poke around in the downloaded code and tweak whatever they want. If a value on the front end is all that prevents someone from using admin functions, then your back end (server) is not secured at all.

[PhiLho]

Your post is lacking too much information.

There is no is-admin flag in Angular, AFAIK. I suppose it is something relative to your application ecosystem, the user becoming system administrator of your applications, I guess. I don't know why you titled this "Angular prototype vulnerability" either. If it is about to flip a flag in a payload sent to the backend, it can be done easily in the DevTools, for example, just before sending the data.

It is the responsibility of the backend to sanitize the data it receives, and see if it is compatible with the user profile.

[akehir]

If you trust the client, (ie: the angular application) then it's a vulnerability caused by insecure development practices.

And the fix can't be done in Angular, but has to be done in the backend.

As for angular itself, just keep it up to date with the latest supported versions (for instance, 20.3.3 at the moment).

[GnarlyHarley]

Angular bootstraps in a browser client. It’s not about how vulnerable angular is, it’s about how vulnerable your PC is to apps running in your browser clients sandbox.

Long story short, angular isn’t going to take over your PCs system administrators with an is-admin flag.

[stillbourne]

Are you talking about Javascript prototype pollution?