CVE-2021-43783: Path Traversal in @backstage/plugin-scaffolder-backend
First published: Mon Nov 29 2021(Updated: )
@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor with write access to a registered scaffolder template is able to manipulate the template in a way that writes files to arbitrary paths on the scaffolder-backend host instance. This vulnerability can in some situation also be exploited through user input when executing a template, meaning you do not need write access to the templates. This method will not allow the attacker to control the contents of the injected file however, unless the template is also crafted in a specific way that gives control of the file contents. This vulnerability is fixed in version `0.15.14` of the `@backstage/plugin-scaffolder-backend`. This attack is mitigated by restricting access and requiring reviews when registering or modifying scaffolder templates.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Backstage Backstage | <0.15.14 | |
| Linuxfoundation Backstage | <0.15.14 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-43783.
What is the affected software?
The affected software is Backstage with versions up to 0.15.14.
What is the severity of CVE-2021-43783?
The severity of CVE-2021-43783 is high with a CVSS score of 8.5.
How can a malicious actor exploit CVE-2021-43783?
A malicious actor with write access to a registered scaffolder template can manipulate the template to write files to arbitrary paths on the scaffolder-backend host.
Are there any references for CVE-2021-43783?
Yes, you can find references for CVE-2021-43783 at the following links: [Link 1](https://github.com/backstage/backstage/commit/f9352ab606367cd9efc6ff048915c70ed3013b7f), [Link 2](https://github.com/backstage/backstage/security/advisories/GHSA-mg3m-f475-28hv).
- collector/nvd-index
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/severity
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/description
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/backstage
- canonical/backstage backstage
- vendor/linuxfoundation
- canonical/linuxfoundation backstage