{"id":"CVE-2023-48225","summary":"Laf env causes sensitive information disclosure","details":"Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization environment, it may lead to sensitive information leakage in secret and configmap. In ES6 syntax, if an obj directly references another obj, the name of the obj itself will be used as the key, and the entire object structure will be integrated intact. When constructing the deployment instance of the app, env was found from the database and directly inserted into the template, resulting in controllability here. Sensitive information in the secret and configmap can be read through the k8s envFrom field. In a privatization environment, when `namespaceConf. fixed` is marked, it may lead to the leakage of sensitive information in the system. As of time of publication, it is unclear whether any patches or workarounds exist.","aliases":["GHSA-hv2g-gxx4-fwxp"],"modified":"2026-08-12T03:51:28.428171681Z","published":"2023-12-12T20:33:40.959Z","database_specific":{"unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"fixed":"1.0.0-beta13"}]}],"cna_assigner":"GitHub_M","cwe_ids":["CWE-200"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48225.json"},"references":[{"type":"WEB","url":"https://github.com/labring/laf/blob/main/server/src/application/environment.controller.ts#L50"},{"type":"WEB","url":"https://github.com/labring/laf/blob/main/server/src/instance/instance.service.ts#L306"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48225.json"},{"type":"ADVISORY","url":"https://github.com/labring/laf/security/advisories/GHSA-hv2g-gxx4-fwxp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-48225"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/labring/laf","events":[{"introduced":"241941d0b5ad5bac8a3cf5b86747b72216971558"},{"last_affected":"27c3b2bc229a355ac2f92026b2b55c05e1095938"}],"database_specific":{"source":"CPE_STRING","cpe":["cpe:2.3:a:laf:laf:0.1.5:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.0:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.1:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.2:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.3:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.4:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.5:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.6:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.7:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.8:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.9:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.10:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.11:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.12:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.13:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.14:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.15:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.16:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.17:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.18:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.19:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.4.20:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.5.0:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.5.1:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.5.2:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.5.3:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.5.4:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.5.5:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.5.6:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.5.7:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.0:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.1:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.2:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.3:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.4:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.5:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.6:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.7:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.8:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.9:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.10:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.11:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.12:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.13:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.14:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.15:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.16:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.17:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.18:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.19:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.20:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.21:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.22:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.6.23:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.7.0:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.7.1:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.7.2:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.7.3:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.7.5:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.7.6:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.7.7:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.7.8:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.7.9:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.7.10:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.7.11:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.8.1:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.8.2:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.8.3:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.8.4:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.8.5:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.8.6:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.8.7:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.8.8:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.8.9:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.8.10:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.8.11:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.8.12:*:*:*:*:*:*:*","cpe:2.3:a:laf:laf:0.8.13:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0.1.5"},{"last_affected":"0.1.5"},{"introduced":"0.4.0"},{"last_affected":"0.4.0"},{"introduced":"0.4.1"},{"last_affected":"0.4.1"},{"introduced":"0.4.2"},{"last_affected":"0.4.2"},{"introduced":"0.4.3"},{"last_affected":"0.4.3"},{"introduced":"0.4.4"},{"last_affected":"0.4.4"},{"introduced":"0.4.5"},{"last_affected":"0.4.5"},{"introduced":"0.4.6"},{"last_affected":"0.4.6"},{"introduced":"0.4.7"},{"last_affected":"0.4.7"},{"introduced":"0.4.8"},{"last_affected":"0.4.8"},{"introduced":"0.4.9"},{"last_affected":"0.4.9"},{"introduced":"0.4.10"},{"last_affected":"0.4.10"},{"introduced":"0.4.11"},{"last_affected":"0.4.11"},{"introduced":"0.4.12"},{"last_affected":"0.4.12"},{"introduced":"0.4.13"},{"last_affected":"0.4.13"},{"introduced":"0.4.14"},{"last_affected":"0.4.14"},{"introduced":"0.4.15"},{"last_affected":"0.4.15"},{"introduced":"0.4.16"},{"last_affected":"0.4.16"},{"introduced":"0.4.17"},{"last_affected":"0.4.17"},{"introduced":"0.4.18"},{"last_affected":"0.4.18"},{"introduced":"0.4.19"},{"last_affected":"0.4.19"},{"introduced":"0.4.20"},{"last_affected":"0.4.20"},{"introduced":"0.5.0"},{"last_affected":"0.5.0"},{"introduced":"0.5.1"},{"last_affected":"0.5.1"},{"introduced":"0.5.2"},{"last_affected":"0.5.2"},{"introduced":"0.5.3"},{"last_affected":"0.5.3"},{"introduced":"0.5.4"},{"last_affected":"0.5.4"},{"introduced":"0.5.5"},{"last_affected":"0.5.5"},{"introduced":"0.5.6"},{"last_affected":"0.5.6"},{"introduced":"0.5.7"},{"last_affected":"0.5.7"},{"introduced":"0.6.0"},{"last_affected":"0.6.0"},{"introduced":"0.6.1"},{"last_affected":"0.6.1"},{"introduced":"0.6.2"},{"last_affected":"0.6.2"},{"introduced":"0.6.3"},{"last_affected":"0.6.3"},{"introduced":"0.6.4"},{"last_affected":"0.6.4"},{"introduced":"0.6.5"},{"last_affected":"0.6.5"},{"introduced":"0.6.6"},{"last_affected":"0.6.6"},{"introduced":"0.6.7"},{"last_affected":"0.6.7"},{"introduced":"0.6.8"},{"last_affected":"0.6.8"},{"introduced":"0.6.9"},{"last_affected":"0.6.9"},{"introduced":"0.6.10"},{"last_affected":"0.6.10"},{"introduced":"0.6.11"},{"last_affected":"0.6.11"},{"introduced":"0.6.12"},{"last_affected":"0.6.12"},{"introduced":"0.6.13"},{"last_affected":"0.6.13"},{"introduced":"0.6.14"},{"last_affected":"0.6.14"},{"introduced":"0.6.15"},{"last_affected":"0.6.15"},{"introduced":"0.6.16"},{"last_affected":"0.6.16"},{"introduced":"0.6.17"},{"last_affected":"0.6.17"},{"introduced":"0.6.18"},{"last_affected":"0.6.18"},{"introduced":"0.6.19"},{"last_affected":"0.6.19"},{"introduced":"0.6.20"},{"last_affected":"0.6.20"},{"introduced":"0.6.21"},{"last_affected":"0.6.21"},{"introduced":"0.6.22"},{"last_affected":"0.6.22"},{"introduced":"0.6.23"},{"last_affected":"0.6.23"},{"introduced":"0.7.0"},{"last_affected":"0.7.0"},{"introduced":"0.7.1"},{"last_affected":"0.7.1"},{"introduced":"0.7.2"},{"last_affected":"0.7.2"},{"introduced":"0.7.3"},{"last_affected":"0.7.3"},{"introduced":"0.7.4"},{"last_affected":"0.7.4"},{"introduced":"0.7.5"},{"last_affected":"0.7.5"},{"introduced":"0.7.6"},{"last_affected":"0.7.6"},{"introduced":"0.7.7"},{"last_affected":"0.7.7"},{"introduced":"0.7.8"},{"last_affected":"0.7.8"},{"introduced":"0.7.9"},{"last_affected":"0.7.9"},{"introduced":"0.7.10"},{"last_affected":"0.7.10"},{"introduced":"0.7.11"},{"last_affected":"0.7.11"},{"introduced":"0.8.0"},{"last_affected":"0.8.0"},{"introduced":"0.8.1"},{"last_affected":"0.8.1"},{"introduced":"0.8.2"},{"last_affected":"0.8.2"},{"introduced":"0.8.3"},{"last_affected":"0.8.3"},{"introduced":"0.8.4"},{"last_affected":"0.8.4"},{"introduced":"0.8.5"},{"last_affected":"0.8.5"},{"introduced":"0.8.6"},{"last_affected":"0.8.6"},{"introduced":"0.8.7"},{"last_affected":"0.8.7"},{"introduced":"0.8.8"},{"last_affected":"0.8.8"},{"introduced":"0.8.9"},{"last_affected":"0.8.9"},{"introduced":"0.8.10"},{"last_affected":"0.8.10"},{"introduced":"0.8.11"},{"last_affected":"0.8.11"},{"introduced":"0.8.12"},{"last_affected":"0.8.12"},{"introduced":"0.8.13"},{"last_affected":"0.8.13"}]}}],"versions":["0.1.5","0.4.0","0.4.1","0.4.10","0.4.11","0.4.12","0.4.13","0.4.14","0.4.15","0.4.16","0.4.17","0.4.18","0.4.19","0.4.2","0.4.20","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.4.8","0.4.9","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7","0.6.0","0.6.1","0.6.10","0.6.11","0.6.12","0.6.13","0.6.14","0.6.15","0.6.16","0.6.17","0.6.18","0.6.19","0.6.2","0.6.20","0.6.21","0.6.22","0.6.23","0.6.3","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.6.9","0.7.0","0.7.1","0.7.10","0.7.11","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.7.8","0.7.9","0.8.0","0.8.1","0.8.10","0.8.11","0.8.12","0.8.13","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.8.9","v0.8.13","v0.8.12","v0.8.11","v0.8.10","v0.8.9","v0.8.8","v0.8.7","v0.8.7-alpha.3","v0.8.7-alpha.2","v0.8.7-alpha.1","v0.8.7-alpha.0","v0.8.6","v0.8.5","v0.8.5-alpha.0","v0.8.4","v0.8.3","v0.8.2","v0.8.1","v0.8.0","v0.8.0-alpha.11","v0.8.0-alpha.10","v0.8.0-alpha.9","v0.8.0-alpha.8","v0.8.0-alpha.7","v0.8.0-alpha.6","v0.8.0-alpha.5","v0.8.0-alpha.4","v0.8.0-alpha.3","v0.8.0-alpha.2","v0.8.0-alpha.1","v0.8.0-alpha.0","v0.7.11","v0.7.10","v0.7.9","v0.7.8","v0.7.7","v0.7.6","v0.7.5","v0.7.4","v0.7.3","v0.7.2","v0.7.1","v0.7.0","v0.6.23","v0.6.22","v0.6.21","v0.6.20","v0.6.19","v0.6.18","v0.6.17","v0.6.16","v0.6.15","v0.6.14","v0.6.13","v0.6.12","v0.6.11","v0.6.10","v0.6.9","v0.6.8","v0.6.7","v0.6.6","v0.6.5","v0.6.4","v0.6.3","v0.6.2","v0.6.1","v0.6.0","v0.6.0-alpha.10","v0.6.0-alpha.9","v0.6.0-alpha.8","v0.6.0-alpha.7","v0.6.0-alpha.6","v0.6.0-alpha.5","v0.6.0-alpha.4","v0.6.0-alpha.3","v0.6.0-alpha.2","v0.6.0-alpha.1","v0.6.0-alpha.0","v0.5.8-alpha.0","v0.5.7","v0.5.7-alpha.0","v0.5.6","v0.5.5","v0.5.5-alpha.0","v0.5.4","v0.5.4-alpha.0","v0.5.3","v0.5.2","v0.5.2-alpha.0","v0.5.1","v0.5.1-alpha.0","v0.5.0","v0.5.0-alpha.3","v0.5.0-alpha.2","v0.5.0-alpha.1","v0.4.21-alpha.0","v0.4.20","v0.4.19","v0.4.18","v0.4.17","v0.4.16","v0.4.15","v0.4.14","v0.4.13","v0.4.12","v0.4.11","v0.4.10","v0.4.9","v0.4.8","v0.4.7","v0.4.6","v0.4.5","v0.4.4","v0.4.3","v0.4.2","v0.4.1","v0.4.0","laf-devops-server@0.0.4","laf-devops-admin@0.0.2","laf-app-server@0.2.7","laf-devops-server@0.0.3","laf-app-server@0.2.6","cloud-function-engine@0.0.6","laf-devops-server@0.0.2","laf-app-server@0.2.5","cloud-function-engine@0.0.5","node-modules-utils@0.0.5","less-api-framework@0.2.4","cloud-function-engine@0.0.4","node-modules-utils@0.0.4","less-api-framework@0.2.3","cloud-function-engine@0.0.3","node-modules-utils@0.0.3","less-api-framework@0.2.2","cloud-function@0.0.2","node-modules-utils@0.0.2","less-api-framework@0.2.1","v0.1.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-48225.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L"}]}