PT-2023-30742 · Laf · Laf

Dvkunion · Published 2023-12-12 · Updated 2023-12-19 · CVE-2023-48225

Positive Technologies (AI Summary)

CVSS v3.1

8.9

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Laf versions prior to 1.0.0-beta.13

Description Laf is a cloud development platform where the control of LAF app environment variables is not strict enough, potentially leading to sensitive information leakage in secret and configmap. This issue arises in certain scenarios of privatization environment. The problem occurs when an object directly references another object in ES6 syntax, and the entire object structure is integrated intact. Sensitive information can be read through the k8s envFrom field, especially when namespaceConf.fixed is marked in a privatization environment.

Recommendations For versions prior to 1.0.0-beta.13, as a temporary workaround, consider restricting access to sensitive information in the secret and configmap to minimize the risk of exploitation. Avoid using the envFrom field in the k8s configuration until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-48225

GHSA-HV2G-GXX4-FWXP

Affected Products

Laf

References · 8

• 🔥 https://github.com/labring/laf/security/advisories/GHSA-hv2g-gxx4-fwxp · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48225.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-48225 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48225 · Vendor Advisory
• https://github.com/labring/laf/blob/main/server/src/instance/instance.service.ts#L306 · Note
• https://github.com/labring/laf/blob/main/server/src/application/environment.controller.ts#L50 · Note
• https://twitter.com/CVEnew/status/1734674638024978562 · Twitter Post
• https://t.me/cvenotify/64184 · Telegram Post