Lucene search

GoogleOSV:GHSA-39V3-F278-VJ3G

HistorySep 17, 2024 - 9:30 p.m.

@backstage/plugin-techdocs-backend storage bucket Directory Traversal vulnerability

2024-09-1721:30:20

Google

osv.dev

aws s3

gcs storage provider

backstage

permission checks

content access

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

19.7%

JSON

Impact

When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks in Backstage.

Patches

This has been fixed in the 1.10.13 release of the @backstage/plugin-techdocs-backend package.

References

If you have any questions or comments about this advisory:

Open an issue in the Backstage repository
Visit our Discord, linked to in Backstage README

References

github.com/backstage/backstage

github.com/backstage/backstage/security/advisories/GHSA-39v3-f278-vj3g

nvd.nist.gov/vuln/detail/CVE-2024-45816

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

19.7%

JSON

Related for OSV:GHSA-39V3-F278-VJ3G