logo

Database

Json Ng Serve Host Check Disabled

Description

Detects when Angular's development server (ng serve) has host checking disabled through package.json scripts. This configuration allows connections from any host/origin, potentially enabling cross-site request forgery (CSRF) attacks and unauthorized access to the development server.

Weakness:

060 - Insecure service configuration - Host verification

Category: Functionality Abuse

Detection Strategy

    • Look for 'scripts' entries in package.json file

    • Check if any script contains 'ng serve' command with '--disable-host-check' flag

    • Check if any script contains 'ng serve' command with '--host 0.0.0.0' flag without proper host restrictions

Vulnerable code example

{
  "name": "vulnerable-app",
  "version": "1.0.0",
  "scripts": {
    "start": "ng serve --disable-host-check",                // Vulnerable: Disables host header validation, enabling host header attacks
    "dev": "ng serve --host 0.0.0.0 --disable-host-check"   // Vulnerable: Combines public access with disabled security check
  }
}

✅ Secure code example

{
  "name": "secure-app",
  "version": "1.0.0",
  "scripts": {
    "start": "ng serve --host localhost",              // Secure: Restricts access to local connections only
    "dev": "ng serve --host localhost --ssl true"      // Secure: Uses SSL and localhost binding for development
  }
}