CVE-2021-41151: Path Traversal in @backstage/plugin-scaffolder-backend
First published: Mon Oct 18 2021(Updated: )
Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a `github:publish:pull-request` action and a particular source path. When the template is executed the sensitive files would be included in the published pull request. This vulnerability is mitigated by the fact that an attacker would need access to create and register templates in the Backstage catalog, and that the attack is very visible given that the exfiltration happens via a pull request. The vulnerability is patched in the `0.15.9` release of `@backstage/plugin-scaffolder-backend`.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linuxfoundation Backstage | >=0.9.4<0.15.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2021-41151.
What is Backstage?
Backstage is an open platform for building developer portals.
What can a malicious actor do with this vulnerability?
A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run.
How is the attack executed?
The attack is executed by crafting a custom Scaffolder template with a `github:publish:pull-request` action and a particular payload.
How can I mitigate this vulnerability?
To mitigate this vulnerability, it is recommended to update Backstage to version 0.15.9 or above.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/severity
- agent/author
- agent/title
- agent/weakness
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- vendor/linuxfoundation
- canonical/linuxfoundation backstage
- version/linuxfoundation backstage/0.9.4