CVE - CVE-2023-48225

CVE-ID
CVE-2023-48225	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization environment, it may lead to sensitive information leakage in secret and configmap. In ES6 syntax, if an obj directly references another obj, the name of the obj itself will be used as the key, and the entire object structure will be integrated intact. When constructing the deployment instance of the app, env was found from the database and directly inserted into the template, resulting in controllability here. Sensitive information in the secret and configmap can be read through the k8s envFrom field. In a privatization environment, when `namespaceConf. fixed` is marked, it may lead to the leakage of sensitive information in the system. As of time of publication, it is unclear whether any patches or workarounds exist.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/labring/laf/blob/main/server/src/application/environment.controller.ts#L50 URL:https://github.com/labring/laf/blob/main/server/src/application/environment.controller.ts#L50 MISC:https://github.com/labring/laf/blob/main/server/src/instance/instance.service.ts#L306 URL:https://github.com/labring/laf/blob/main/server/src/instance/instance.service.ts#L306 MISC:https://github.com/labring/laf/security/advisories/GHSA-hv2g-gxx4-fwxp URL:https://github.com/labring/laf/security/advisories/GHSA-hv2g-gxx4-fwxp
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20231113	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20231113)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)