Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0yZmM5LXhwcDgtMmc5aM4AA5ef

`@backstage/backend-common` vulnerable to path traversal through symlinks

Impact

Paths checks with the resolveSafeChildPath utility were not exhaustive enough, leading to risk of path traversal vulnerabilities if symlinks can be injected by attackers.

Patches

Patched in @backstage/backend-common version 0.21.1.
Patched in @backstage/backend-common version 0.20.2.
Patched in @backstage/backend-common version 0.19.10.

For more information

If you have any questions or comments about this advisory:

• Open an issue in the Backstage repository
• Visit our Discord, linked to in Backstage README

Permalink: https://github.com/advisories/GHSA-2fc9-xpp8-2g9h
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yZmM5LXhwcDgtMmc5aM4AA5ef
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 2 months ago
Updated: 2 months ago

CVSS Score: 8.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Identifiers: GHSA-2fc9-xpp8-2g9h, CVE-2024-26150
References:

• https://github.com/backstage/backstage/security/advisories/GHSA-2fc9-xpp8-2g9h
• https://github.com/backstage/backstage/commit/1ad2b1b61ebb430051f7d804b0cc7ebfe7922b6f
• https://github.com/backstage/backstage/commit/78f892b3a84d63de2ba167928f171154c447b717
• https://github.com/backstage/backstage/commit/edf65d7d31e027599c2415f597d085ee84807871
• https://nvd.nist.gov/vuln/detail/CVE-2024-26150
• https://github.com/advisories/GHSA-2fc9-xpp8-2g9h

Repository: https://github.com/backstage/backstage
Blast Radius: 23.3

Affected Packages