CVE-2024-26150: `@backstage/backend-common` vulnerable to path traversal through symlinks
Impact
Paths checks with the resolveSafeChildPath utility were not exhaustive enough, leading to risk of path traversal vulnerabilities if symlinks can be injected by attackers.
Patches Patched in @backstage/backend-common version 0.21.1. Patched in @backstage/backend-common version 0.20.2. Patched in @backstage/backend-common version 0.19.10.
For more information If you have any questions or comments about this advisory:
- Open an issue in the Backstage repository - Visit our Discord, linked to in Backstage README
Other sources
@backstage/backend-common is a common functionality library for backends for Backstage, an open platform for building developer portals. In @backstage/backend-common prior to versions 0.21.1, 0.20.2, and 0.19.10, paths checks with the resolveSafeChildPath utility were not exhaustive enough, leading to risk of path traversal vulnerabilities if symlinks can be injected by attackers. This issue is patched in @backstage/backend-common versions 0.21.1, 0.20.2, and 0.19.10.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@backstage/backend-commonto a version that resolves this vulnerability.Fixed in 0.20.2 - Upgrade
Upgrade
npm/@backstage/backend-commonto a version that resolves this vulnerability.Fixed in 0.19.10 - Upgrade
Upgrade
npm/@backstage/backend-commonto a version that resolves this vulnerability.Fixed in 0.21.1 - Upgrade
Upgrade
@backstage/backend-commonto a version that resolves this vulnerability.Fixed in 0.19.10 - Upgrade
Upgrade
@backstage/backend-commonto a version that resolves this vulnerability.Fixed in 0.20.2 - Upgrade
Upgrade
@backstage/backend-commonto a version that resolves this vulnerability.Fixed in 0.21.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26150?
CVE-2024-26150 is a vulnerability that poses risks for path traversal attacks due to inadequate path checks.
How do I fix CVE-2024-26150?
To fix CVE-2024-26150, upgrade to version 0.21.1 or higher of the @backstage/backend-common package.
What versions are affected by CVE-2024-26150?
CVE-2024-26150 affects versions 0.19.10 and up to 0.20.2 of the @backstage/backend-common package.
What are the potential impacts of CVE-2024-26150?
The potential impacts of CVE-2024-26150 include exploitation by attackers to perform unauthorized path traversal actions.
Is CVE-2024-26150 specific to any platform?
CVE-2024-26150 specifically affects the Backstage application running on Node.js.