Executive brief
angular-server-side-configuration is a build-time tool used in Angular CLI projects to detect and inject environment variables into web applications. In version 15.0.0, the environment variable scanning was expanded project-wide, causing backend environment variables in monorepo setups to be inadvertently written to a publicly accessible configuration file (ngssc.json) and exposed in the application's index.html. This could expose sensitive backend credentials, API keys, and database connection strings to attackers who access the compiled application.
Technical details
The vulnerability is an information disclosure issue (CWE-200, CWE-538) affecting angular-server-side-configuration version 15.0.0. The tool scans TypeScript source files to detect environment variable usage and writes them to an ngssc.json file in the build output directory. In version 15, the scan scope was broadened to cover the entire project relative to angular.json, which in monorepo configurations inadvertently includes backend service directories. Backend environment variables intended for Node.js services are then embedded into the web application's index.html file and exposed to client-side code. The vulnerability requires no authentication, has network-accessible attack surface, and affects only monorepo setups with backend components. Patched in version 15.1.0 via the addition of a configurable searchPattern option to restrict file scanning by default.
Affected products
- kyubisation angular-server-side-configuration 15.0.0 to before 15.1.0
Timeline
- 2023-03-24: disclosed
- 2023-03-24: patched: Fixed in version 15.1.0