Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS00anFjLWp2aDItcHhnOc4AArtF

Path traversal for local publishers in TechDocs backend

Impact

A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when techdocs.publisher.type is set to local.

This vulnerability is mitigated by the fact that the Software Catalog must be configured with non-standard field format validators and/or non-standard entity policies.

Patches

Those affected are advised to upgrade to @backstage/plugin-techdocs-node version 1.1.2 or higher.

Workarounds

If patching or upgrading is not possible, it would be sufficient to update any custom Catalog field format validators and/or custom entity policies to disallow entity names, kinds, and namespaces containing ..

For more information

If you have any questions or comments about this advisory:

• Open an issue in the Backstage repository
• Visit our chat, linked to in the Backstage README

Permalink: https://github.com/advisories/GHSA-4jqc-jvh2-pxg9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00anFjLWp2aDItcHhnOc4AArtF
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: over 1 year ago

Identifiers: GHSA-4jqc-jvh2-pxg9
References:

• https://github.com/backstage/backstage/security/advisories/GHSA-4jqc-jvh2-pxg9
• https://github.com/backstage/backstage/commit/429c9f9daa5654dd1b996aa85f7264eb23a2e4fa
• https://github.com/advisories/GHSA-4jqc-jvh2-pxg9

Repository: https://github.com/backstage/backstage
Blast Radius: 0.0

Affected Packages