GHSA-4xvq-3m68-h444: Medium severity npm/@backstage/plugin-scaffolder-backend vulnerability
Impact
An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates. Exploitation requires a denied action whose input contains such a value.
Patches
Patched in @backstage/plugin-scaffolder-backend version 4.1.0
Workarounds
- Restrict scaffolder task creation and task-log reading to trusted users. - Avoid placing centrally managed sensitive values in inputs to actions that may be denied until upgrading.
References
- Backstage threat model - Backstage permissions overview
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@backstage/plugin-scaffolder-backendto a version that resolves this vulnerability.Fixed in 4.1.0 - Upgrade
Upgrade
@backstage/plugin-scaffolder-backendto a version that resolves this vulnerability.Fixed in 4.1.0 - Compensating control
Avoid placing centrally managed sensitive values in inputs to actions that may be denied until upgrading.
- Compensating control
Restrict scaffolder task creation and task-log reading to trusted users.
Event History
Frequently Asked Questions
Which deployments are most exposed?
Deployments using restrictive scaffolder action permissions are exposed when affected templates pass centrally managed sensitive values as inputs to actions that may be denied. The issue is relevant only where authenticated users can both create scaffolder tasks and read their logs.
What must an attacker be able to do to exploit this?
The attacker must be authenticated and able to create and read scaffolder tasks. Exploitation also requires triggering a denied action whose input contains a sensitive value.
What can be done before upgrading?
Restrict scaffolder task creation and task-log reading to trusted users. Avoid putting centrally managed sensitive values into inputs for actions that could be denied.
What version fixes the issue?
Upgrade @backstage/plugin-scaffolder-backend to version 4.1.0 or later.