CVE-2023-28444
📋 TL;DR
CVE-2023-28444 is an information exposure vulnerability in angular-server-side-configuration where environment variables intended for backend services in monorepo setups could be exposed in the frontend application's index.html file. This affects Angular projects using angular-server-side-configuration version 15.0.0 in monorepo configurations with backend components. The vulnerability allows sensitive backend environment variables to be publicly accessible through the web application.
💻 Affected Systems
- angular-server-side-configuration
📦 What is this software?
Angular Server Side Configuration by Angular Server Side Configuration Project
⚠️ Risk & Real-World Impact
Worst Case
Sensitive backend credentials, API keys, database connection strings, and other secrets are exposed publicly through the web application, leading to complete system compromise.
Likely Case
Backend environment variables containing non-critical configuration data are exposed, potentially revealing internal system details and architecture.
If Mitigated
No exposure occurs as environment variable detection is properly restricted to frontend files only.
🎯 Exploit Status
This is an information exposure vulnerability rather than an active exploit. The sensitive data is already present in the deployed application.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 15.1.0
Vendor Advisory: https://github.com/kyubisation/angular-server-side-configuration/security/advisories/GHSA-gwvm-vrp4-4pp5
Restart Required: Yes
Instructions:
1. Update angular-server-side-configuration to version 15.1.0 or later. 2. Run npm update angular-server-side-configuration. 3. Rebuild and redeploy your Angular application. 4. The new version includes a searchPattern option that restricts environment variable detection by default.
🔧 Temporary Workarounds
Manual ngssc.json configuration
allManually create or edit the ngssc.json file to explicitly define which environment variables should be included, preventing automatic detection of backend variables.
Create ngssc.json with explicit variable definitions or edit existing file to remove backend variables
Post-generation script cleanup
allRun a script after ngssc.json generation to remove any backend environment variables that were incorrectly detected.
Create a script to filter out backend variables from ngssc.json before deployment
🧯 If You Can't Patch
- Isolate frontend and backend into separate repositories or projects to prevent cross-detection of environment variables.
- Implement strict Content Security Policies and network segmentation to limit access to the exposed application.
🔍 How to Verify
Check if Vulnerable:
Check if using angular-server-side-configuration version 15.0.0 in a monorepo setup, then inspect the deployed index.html for exposed environment variables that should only be in backend.Check Version:
npm list angular-server-side-configurationVerify Fix Applied:
Verify angular-server-side-configuration version is 15.1.0 or later, and check that backend environment variables no longer appear in the deployed index.html.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to index.html or configuration endpoints
Network Indicators:
- HTTP requests specifically targeting index.html source inspection
SIEM Query:
Search for web server logs showing repeated GET requests to index.html with user agents suggesting source code inspection.🔗 References
- https://github.com/kyubisation/angular-server-side-configuration/commit/d701f51260637a84ede278e248934e0437a7ff86
- https://github.com/kyubisation/angular-server-side-configuration/releases/tag/v15.1.0
- https://github.com/kyubisation/angular-server-side-configuration/security/advisories/GHSA-gwvm-vrp4-4pp5
- https://github.com/kyubisation/angular-server-side-configuration/commit/d701f51260637a84ede278e248934e0437a7ff86
- https://github.com/kyubisation/angular-server-side-configuration/releases/tag/v15.1.0
- https://github.com/kyubisation/angular-server-side-configuration/security/advisories/GHSA-gwvm-vrp4-4pp5
