PT-2023-21727 · Unknown · Angular-Server-Side-Configuration

Milo526 · Published 2023-03-24 · Updated 2023-04-03 · CVE-2023-28444

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions angular-server-side-configuration versions 15.0.0 through 15.0.x

Description The issue concerns the detection of environment variables in TypeScript files during the build time of an Angular CLI project. These variables are written to a ngssc.json file and later inserted into the app's index.html file. In a monorepo setup, this could lead to the exposure of environment variables intended for a backend or service via index.html. This has no impact on plain Angular projects without a backend component.

Recommendations For angular-server-side-configuration versions 15.0.0 through 15.0.x, update to version 15.1.0, which adds an option searchPattern to restrict the detection file range by default. Alternatively, manually edit or create ngssc.json, or run a script after ngssc.json generation as a temporary workaround.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-538

Related Identifiers

CVE-2023-28444

GHSA-GWVM-VRP4-4PP5

Affected Products

Angular-Server-Side-Configuration

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28444.json · Exploit
• https://github.com/kyubisation/angular-server-side-configuration/commit/d701f51260637a84ede278e248934e0437a7ff86 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-28444 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28444 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gwvm-vrp4-4pp5 · Vendor Advisory
• https://github.com/kyubisation/angular-server-side-configuration/releases/tag/v15.1.0 · Note
• https://github.com/kyubisation/angular-server-side-configuration/security/advisories/GHSA-gwvm-vrp4-4pp5 · Note
• https://github.com/kyubisation/angular-server-side-configuration · Note
• https://t.me/cibsecurity/60674 · Telegram Post