CVE-2023-28444

angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend

Workarounds

Manually edit or create ngssc.json or run a script after ngssc.json generation

References

angular-server-side-configuration detects used environment variables in TypeScript (.ts) files during build time of an Angular CLI project. The detected environment variables are written to a ngssc.json file in the output directory.
During deployment of an Angular based app, the environment variables based on the variables from ngssc.json are inserted into the apps index.html (or defined index file).

With version 15 the environment variable detection was widened to the entire project, relative to the angular.json file from the Angular CLI. In a monorepo setup, this could lead to environment variables intended for a backend/service to be detected and written to the ngssc.json, which would then be populated and exposed via index.html.

This has NO IMPACT, in a plain Angular project that has no backend component.

CVE-2023-28444 has a CVSS score of 9.9 (Critical). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (15.1.0); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

Vulnerability has been mitigated in 15.1.0, by adding an option searchPattern which restricts the detection file range by default.

# Update via npm
npm update angular-server-side-configuration
## Or more specific
npm install [email protected]

# Update via pnpm
pnpm update angular-server-side-configuration
## Or more specific
pnpm add [email protected]

# Update via yarn
yarn update angular-server-side-configuration
## Or more specific
yarn add [email protected]

1. What is CVE-2023-28444? CVE-2023-28444 is a critical-severity security vulnerability in angular-server-side-configuration (npm), affecting versions >= 15.0.0, < 15.1.0. It is fixed in 15.1.0.
2. How severe is CVE-2023-28444? CVE-2023-28444 has a CVSS score of 9.9 (Critical). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of angular-server-side-configuration are affected by CVE-2023-28444? angular-server-side-configuration (npm) versions >= 15.0.0, < 15.1.0 is affected.
4. Is there a fix for CVE-2023-28444? Yes. CVE-2023-28444 is fixed in 15.1.0. Upgrade to this version or later.
5. Is CVE-2023-28444 exploitable, and should I be worried? Whether CVE-2023-28444 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2023-28444 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2023-28444? Upgrade angular-server-side-configuration to 15.1.0 or later.