angular-server-side-configuration 15.0.0 Environment Variable ngssc.json information disclosure

Summaryinfo

A vulnerability was found in angular-server-side-configuration 15.0.0. It has been rated as problematic. This affects an unknown function of the file ngssc.json of the component Environment Variable Handler. This manipulation causes information disclosure. This vulnerability is registered as CVE-2023-28444. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in angular-server-side-configuration 15.0.0 (JavaScript Library) and classified as problematic. Affected by this vulnerability is an unknown function of the file ngssc.json of the component Environment Variable Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. The summary by CVE is:

angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker container via environment variables. angular-server-side-configuration detects used environment variables in TypeScript (.ts) files during build time of an Angular CLI project. The detected environment variables are written to a ngssc.json file in the output directory. During deployment of an Angular based app, the environment variables based on the variables from ngssc.json are inserted into the apps index.html (or defined index file). With version 15.0.0 the environment variable detection was widened to the entire project, relative to the angular.json file from the Angular CLI. In a monorepo setup, this could lead to environment variables intended for a backend/service to be detected and written to the ngssc.json, which would then be populated and exposed via index.html. This has NO IMPACT, in a plain Angular project that has no backend component. This vulnerability has been mitigated in version 15.1.0, by adding an option `searchPattern` which restricts the detection file range by default. As a workaround, manually edit or create ngssc.json or run script after ngssc.json generation.

The weakness was published 03/25/2023 as GHSA-gwvm-vrp4-4pp5. The advisory is shared at github.com. This vulnerability is known as CVE-2023-28444 since 03/15/2023. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

By approaching the search of inurl:ngssc.json it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 15.1.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch d701f51260637a84ede278e248934e0437a7ff86 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• JavaScript Library

Name

• angular-server-side-configuration

Version

• 15.0.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion