GHSA-3xr5-8w6c-p5gw: Medium severity npm/@backstage/backend-defaults vulnerability
Impact
An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced.
Patches
Patched in @backstage/backend-defaults version 0.17.8
Workarounds
Limit access to action invocation endpoints to trusted service callers until upgrading.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@backstage/backend-defaultsto a version that resolves this vulnerability.Fixed in 0.17.8 - Upgrade
Upgrade
@backstage/backend-defaultsto a version that resolves this vulnerability.Fixed in 0.17.8 - Compensating control
Limit access to action invocation endpoints to trusted service callers until upgrading.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can reach the action invocation endpoints could invoke actions excluded by the operator's action configuration. The issue does not bypass existing action permissions or downstream authorization.
What should be done if upgrading is not immediately possible?
Limit access to action invocation endpoints to trusted service callers until an upgrade can be completed.
Which version contains the fix?
The issue is patched in @backstage/backend-defaults version 0.17.8.