Dvkunion

**Nome do software vulnerável e versões afetadas** Versões 1.0.0-beta.13 e anteriores do Laf **Descrição** O Laf é uma plataforma de desenvolvimento em nuvem que utiliza comunicação com o k8s para recuperar rapidamente logs do contêiner sem a necessidade de armazenamento adicional. No entanto, a interface não verifica as permissões do pod, o que permite que usuários autenticados obtenham quaisquer logs de pods no mesmo namespace por meio desse método, obtendo assim informações confidenciais contidas nos logs. **Recomendações** Para as versões 1.0.0-beta.13 e anteriores, como solução temporária, considere restringir o acesso à interface de recuperação de logs para minimizar o risco de exploração. No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** Laf versions prior to 1.0.0-beta.13 **Description** Laf is a cloud development platform where the control of LAF app environment variables is not strict enough, potentially leading to sensitive information leakage in secret and configmap. This issue arises in certain scenarios of privatization environment. The problem occurs when an object directly references another object in ES6 syntax, and the entire object structure is integrated intact. Sensitive information can be read through the k8s envFrom field, especially when `namespaceConf.fixed` is marked in a privatization environment. **Recommendations** For versions prior to 1.0.0-beta.13, as a temporary workaround, consider restricting access to sensitive information in the secret and configmap to minimize the risk of exploitation. Avoid using the `envFrom` field in the k8s configuration until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sealos versions 4.2.0 and prior **Description** Sealos, a Cloud Operating System for managing cloud-native applications, has a permission flaw in its billing system. This flaw allows users to control the recharge resource account via the `sealos.io/v1/Payment` endpoint, enabling them to recharge any amount of 1 renminbi (RMB). The charging interface may expose resource information, and the namespace of this custom resource is under the user's control, potentially allowing permission to correct it. **Recommendations** For Sealos versions 4.2.0 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the `sealos.io/v1/Payment` endpoint to minimize the risk of exploitation. Additionally, avoid using the custom resource associated with this endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Sealos versions prior to 4.2.1-rc4 **Description** The issue is related to an improper configuration of role-based access control (RBAC) permissions in Sealos, an open-source cloud operating system distribution based on the Kubernetes kernel. This configuration flaw allows an attacker to obtain cluster control permissions, potentially controlling the entire cluster, hundreds of pods, and other resources within the cluster. The estimated number of potentially affected devices is not specified. **Recommendations** For Sealos versions prior to 4.2.1-rc4, upgrade to version 4.2.1-rc4 or later to address the issue. As a temporary workaround, consider restricting access to RBAC permissions to minimize the risk of exploitation. There are no known workarounds for this issue other than upgrading to the fixed version.