PT-2021-23131 · Unknown · @Backstage/Plugin-Scaffolder-Backend

Rugvip · Published 2021-10-18 · Updated 2021-10-22 · CVE-2021-41151

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions @backstage/plugin-scaffolder-backend versions prior to 0.15.9

Description A malicious actor could read sensitive files from the environment where Scaffolder tasks are run by crafting a custom Scaffolder template with a github:publish:pull-request action and a particular source path. When the template is executed, the sensitive files would be included in the published pull request. This issue is mitigated by the fact that an attacker would need access to create and register templates in the Backstage catalog, and that the attack is very visible given that the exfiltration happens via a pull request.

Recommendations For versions prior to 0.15.9, update to the 0.15.9 release of @backstage/plugin-scaffolder-backend to patch the vulnerability. As a temporary workaround, consider restricting access to create and register templates in the Backstage catalog to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-41151

GHSA-PVV8-8FX9-H673

Affected Products

@Backstage/Plugin-Scaffolder-Backend

References · 8

• https://github.com/backstage/backstage/commit/6968962c920508eae19a4c1c200fa2c8980a4006 · Patch
• https://osv.dev/vulnerability/GHSA-pvv8-8fx9-h673 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41151 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41151 · Vendor Advisory
• https://github.com/backstage/backstage · Note
• https://github.com/backstage/backstage/security/advisories/GHSA-pvv8-8fx9-h673 · Note
• https://github.com/backstage/backstage/releases/tag/release-2021-10-16 · Note
• https://t.me/cibsecurity/30738 · Telegram Post