CVE-2023-28444 — angular-server-side-confi…
CRITICALFix: kyubisation/angular-server-side-configuration@d701f51CVE-2023-28444 is a critical-severity (CVSS 9.9) Information Exposure vulnerability in angular-server-side-configuration. A fix is available for angular-server-side-configuration — see the affected versions and patch details below.
angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2023-28444.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
angular-server-side-configurationnpmDescription
Impact
angular-server-side-configuration detects used environment variables in TypeScript (.ts) files during build time of an Angular CLI project. The detected environment variables are written to a ngssc.json file in the output directory. During deployment of an Angular based app, the environment variables based on the variables from ngssc.json are inserted into the apps index.html (or defined index file).
With version 15 the environment variable detection was widened to the entire project, relative to the angular.json file from the Angular CLI. In a monorepo setup, this could lead to environment variables intended for a backend/service to be detected and written to the ngssc.json, which would then be populated and exposed via index.html.
This has NO IMPACT, in a plain Angular project that has no backend component.
Patches
Vulnerability has been mitigated in 15.1.0, by adding an option searchPattern which restricts the detection file range by default.
# Update via npm
npm update angular-server-side-configuration
## Or more specific
npm install [email protected]
# Update via pnpm
pnpm update angular-server-side-configuration
## Or more specific
pnpm add [email protected]
# Update via yarn
yarn update angular-server-side-configuration
## Or more specific
yarn add [email protected]
Workarounds
Manually edit or create ngssc.json or run a script after ngssc.json generation
References
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | angular-server-side-configuration | ≥ 15.0.0&&< 15.1.0 | 15.1.0npm install angular-server-side-configuration@15.1.0 |
Affected Products
angular-server-side-configurationangular-server-side-configuration_projectDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for angular-server-side-configuration, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update angular-server-side-configuration to 15.1.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2023-28444 is resolved across your whole dependency graph.
Workarounds
Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.
Frequently Asked Questions
Is CVE-2023-28444 in your dependencies?
Find it across npm, including transitive dependencies.