Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

A Path Traversal vulnerability exists in the prerendered (SSG) page retrieval logic of CommonEngine in @angular/ssr/node (and @angular/ssr in earlier versions). When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serve prerendered pages from sibling output directories.

The vulnerability occurs due to how relative URLs and Windows file paths are resolved and validated:

1. A request URL containing a backslash parent traversal segment (e.g., /..\app-admin) is passed to CommonEngine.render({ url }).
2. The engine parses the URL using new URL(url, 'resolve://'). Because resolve:// is a non-special scheme under the WHATWG URL standard, backslashes are not normalized to forward slashes, leaving the pathname unnormalized as /..\app-admin.
3. The engine constructs the candidate file path using join(publicPath, pathname, 'index.html'). On Windows, path.join treats \ as a path delimiter, resolving the parent segment (..\) out of publicPath (e.g., dist\app) into a sibling directory (e.g., dist\app-admin\index.html).
4. The containment check (pagePath.startsWith(normalize(publicPath))) performs a prefix match without a trailing path delimiter. Because the sibling folder name starts with the configured public folder name (e.g., dist\app-admin starts with dist\app), the check erroneously succeeds.
5. If the target file exists and contains the Angular SSG marker (ng-server-context="...ssg..."), CommonEngine reads and serves the sibling page instead of rendering the requested route.

Impact

This vulnerability allows unauthorized access to prerendered static pages from adjacent applications or build outputs:

• Information Disclosure: Prerendered HTML pages located in sibling directories sharing the same name prefix as the public directory (e.g., an internal administration app app-admin adjacent to app) can be accessed by unauthorized users.
• Limited Scope: Only HTML files matching the Angular SSG marker regex are served. Arbitrary non-Angular files, secrets, or configuration files without the SSG context attribute cannot be read through this mechanism.

Attack Preconditions