CVE-2023-28444: Angular server side configuration Angular-server-side-configuration Information Disclosure Vulnerability Vulnerability

CRITICAL
Advisory Identifier: GHSA-gwvm-vrp4-4pp5
Share
CVSS 9.9
CWE-538 CWE-200
Published
Advisory Summary

CVE-2023-28444 is a CRITICAL (CVSS 9.9) angular-server-side-configuration information disclosure vulnerability vulnerability (CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory) affecting Angular server side configuration libraries in the npm ecosystem. The issue involves angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend. Remediation is available by upgrading affected packages to version 15.1.0.

CVE-2023-28444 at a Glance

CVE Identifier CVE-2023-28444
GHSA Identifier GHSA-gwvm-vrp4-4pp5
Severity CRITICAL
CVSS v3.1 Base Score 9.9
CWE Classification CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory
Affected Product Angular server side configuration
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 9.9

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Changed (S:C)
Confidentiality High (C:H)
Integrity Low (I:L)
Availability Low (A:L)

How to Fix CVE-2023-28444

To remediate this vulnerability, upgrade all affected Angular server side configuration dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

angular-server-side-configuration fixed: 15.1.0 
npm install angular-server-side-configuration@15.1.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls angular-server-side-configuration

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2023-28444, inspect your project dependencies using npm:

npm ls angular-server-side-configuration

Analyze the terminal output to locate any version of Angular server side configuration in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 15.1.0), your application is affected.

Note: The npm ls angular-server-side-configuration command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory, where the product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information. In Angular server side configuration, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact angular-server-side-configuration detects used environment variables in TypeScript (.ts) files during build time of an Angular CLI project. The detected environment variables are written to a ngssc.json file in the output directory. During deployment of an Angular based app, the environment variables based on the variables from ngssc.json are inserted into the apps index.html (or defined index file). With version 15 the environment variable detection was widened to the entire project, relative to the angular.json file from the Angular CLI. In a monorepo setup, this could lead to environment variables intended for a backend/service to be detected and written to the ngssc.json, which would then be populated and exposed via index.html. This has NO IMPACT, in a plain Angular project that has no backend component. ### Patches Vulnerability has been mitigated in 15.1.0, by adding an option `searchPattern` which restricts the detection file range by default. ```bash # Update via npm npm update angular-server-side-configuration ## Or more specific npm install angular-server-side-configuration@15.1.0 # Update via pnpm pnpm update angular-server-side-configuration ## Or more specific pnpm add angular-server-side-configuration@15.1.0 # Update via yarn yarn update angular-server-side-configuration ## Or more specific yarn add angular-server-side-configuration@15.1.0 ``` ### Workarounds Manually edit or create ngssc.json or run a script after ngssc.json generation ### References

CVE-2023-28444 Affected Angular server side configuration Versions

1 component(s)
Fixed Versions:
15.1.0
Product / Package Ecosystem Affected Versions Fixed Version
angular-server-side-configuration
npm/angular-server-side-configuration
npm
≥ 15.0.0
< 15.1.0
15.1.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/kyubisation/angular-server-side-configuration/security/advisories/GHSA-gwvm-vrp4-4pp5
NVD — CVE-2023-28444 NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-28444
Security Fix Commit FIX COMMIT
https://github.com/kyubisation/angular-server-side-configuration/commit/d701f51260637a84ede278e248934e0437a7ff86
Angular server side configuration Source Repository REPOSITORY
https://github.com/kyubisation/angular-server-side-configuration
Angular server side configuration Release RELEASE
https://github.com/kyubisation/angular-server-side-configuration/releases/tag/v15.1.0

Frequently Asked Questions

What is CVE-2023-28444?
CVE-2023-28444 is a security vulnerability in Angular server side configuration involving angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend under CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory.
Which Angular server side configuration versions are affected?
Affected versions include releases prior to 15.1.0 across affected packages: angular-server-side-configuration.
What version fixes CVE-2023-28444?
Upgrading to 15.1.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is angular-server-side-configuration affected?
Yes, angular-server-side-configuration is affected in releases prior to 15.1.0. Upgrade your dependency to 15.1.0 or later.
What is the CVSS score of CVE-2023-28444?
CVE-2023-28444 has a CVSS v3.1 base score of 9.9 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L.
What CWE is associated with CVE-2023-28444?
CVE-2023-28444 is classified under CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory (The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.).
How can I check npm dependencies for CVE-2023-28444?
Run the dependency tree command: 'npm ls angular-server-side-configuration'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-gwvm-vrp4-4pp5",
  "modified" : "2023-03-24T22:04:35Z",
  "published" : "2023-03-24T22:04:35Z",
  "aliases" : [ "CVE-2023-28444" ],
  "summary" : "angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend",
  "details" : "### Impact\nangular-server-side-configuration detects used environment variables in TypeScript (.ts) files during build time of an Angular CLI project. The detected environment variables are written to a ngssc.json file in the output directory.\nDuring deployment of an Angular based app, the environment variables based on the variables from ngssc.json are inserted into the apps index.html (or defined index file).\n\nWith version 15 the environment variable detection was widened to the entire project, relative to the angular.json file from the Angular CLI. In a monorepo setup, this could lead to environment variables intended for a backend/service to be detected and written to the ngssc.json, which would then be populated and exposed via index.html.\n\nThis has NO IMPACT, in a plain Angular project that has no backend component.\n\n### Patches\nVulnerability has been mitigated in 15.1.0, by adding an option `searchPattern` which restricts the detection file range by default.\n\n```bash\n# Update via npm\nnpm update angular-server-side-configuration\n## Or more specific\nnpm install angular-server-side-configuration@15.1.0\n\n# Update via pnpm\npnpm update angular-server-side-configuration\n## Or more specific\npnpm add angular-server-side-configuration@15.1.0\n\n# Update via yarn\nyarn update angular-server-side-configuration\n## Or more specific\nyarn add angular-server-side-configuration@15.1.0\n```\n\n### Workarounds\nManually edit or create ngssc.json or run a script after ngssc.json generation\n\n### References\n\n ",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "angular-server-side-configuration"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "15.0.0"
      }, {
        "fixed" : "15.1.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/kyubisation/angular-server-side-configuration/security/advisories/GHSA-gwvm-vrp4-4pp5"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-28444"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/kyubisation/angular-server-side-configuration/commit/d701f51260637a84ede278e248934e0437a7ff86"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/kyubisation/angular-server-side-configuration"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/kyubisation/angular-server-side-configuration/releases/tag/v15.1.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200", "CWE-538" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-03-24T22:04:35Z",
    "nvd_published_at" : "2023-03-24T20:15:00Z"
  }
}