PT-2023-21727 · Unknown · Angular-Server-Side-Configuration

Milo526 · Publicado 2023-03-24 · Atualizado 2023-04-03 · CVE-2023-28444

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions angular-server-side-configuration versions 15.0.0 through 15.0.x

Description The issue concerns the detection of environment variables in TypeScript files during the build time of an Angular CLI project. These variables are written to a ngssc.json file and later inserted into the app's index.html file. In a monorepo setup, this could lead to the exposure of environment variables intended for a backend or service via index.html. This has no impact on plain Angular projects without a backend component.

Recommendations For angular-server-side-configuration versions 15.0.0 through 15.0.x, update to version 15.1.0, which adds an option searchPattern to restrict the detection file range by default. Alternatively, manually edit or create ngssc.json, or run a script after ngssc.json generation as a temporary workaround.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

CWE-538

Identificadores relacionados

CVE-2023-28444

GHSA-GWVM-VRP4-4PP5

Produtos afetados

Angular-Server-Side-Configuration

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28444.json · Exploit
• https://github.com/kyubisation/angular-server-side-configuration/releases/tag/v15.1.0 · Nota
• https://github.com/kyubisation/angular-server-side-configuration/commit/d701f51260637a84ede278e248934e0437a7ff86 · Correção
• https://github.com/kyubisation/angular-server-side-configuration/security/advisories/GHSA-gwvm-vrp4-4pp5 · Nota
• https://github.com/kyubisation/angular-server-side-configuration · Nota
• https://t.me/cibsecurity/60674 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-28444 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-28444 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-gwvm-vrp4-4pp5 · Aviso do Fabricante