CVSS: 9.6EPSS: 0%CPEs: 139EXPL: 1CVE-2023-50253 – laf logs leak
https://notcve.org/view.php?id=CVE-2023-50253
Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the need for additional storage. However, in version 1.0.0-beta.13 and prior, this interface does not verify the permissions of the pod, which allows authenticated users to obtain any pod logs under the same namespace through this method, thereby obtaining sensitive information printed in the logs. As of time of publication, no known patched versions exist. Laf es una plataforma de desarrollo en la nube. • https://github.com/labring/laf/pull/1468 https://github.com/labring/laf/security/advisories/GHSA-g9c8-wh35-g75f • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 9.1EPSS: 0%CPEs: 140EXPL: 1CVE-2023-48225 – Laf env causes sensitive information disclosure
https://notcve.org/view.php?id=CVE-2023-48225
Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization environment, it may lead to sensitive information leakage in secret and configmap. In ES6 syntax, if an obj directly references another obj, the name of the obj itself will be used as the key, and the entire object structure will be integrated intact. When constructing the deployment instance of the app, env was found from the database and directly inserted into the template, resulting in controllability here. Sensitive information in the secret and configmap can be read through the k8s envFrom field. • https://github.com/labring/laf/blob/main/server/src/application/environment.controller.ts#L50 https://github.com/labring/laf/blob/main/server/src/instance/instance.service.ts#L306 https://github.com/labring/laf/security/advisories/GHSA-hv2g-gxx4-fwxp • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •