CVE-2024-53983 Server-side request forgery in Backstage Scaffolder plugin

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20240116021644, <=0.1.1-next.2), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-2021101022158, <=0.0.0-nightly-20260928023907) +25 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (>=0.0.0-nightly-20240929023448, <=0.4.3)

@backstage/plugin-scaffolder-node NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240116021644, =0.0.0-nightly-2021101022158, =0.0.0-nightly-20231213021616, =0.0.0-nightly-20231213021616, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20230325022054,...

@backstage/backend-dynamic-feature-service (>=0.4.4-next.0, <=0.5.0-next.3), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20241017023338, <=1.27.0-next.3) +10 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (>=0.5.0, <=0.5.1-next.3)

@backstage/plugin-scaffolder-node NPM version =0.5.0, =0.4.4-next.0, =0.0.0-nightly-20241017023338, =0.2.2-next.0, =0.3.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.4.3-next.0, =0.1.15-next.0, =0.1.15-next.3 Source cves: CVE-2024-53983...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20241120023536, <=0.5.1-next.0), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20241120023536, <=1.28.0-next.0) +11 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (>=0.6.0, <=0.6.1-next.0)

@backstage/plugin-scaffolder-node NPM version =0.6.0, =0.0.0-nightly-20241120023536, =0.0.0-nightly-20241120023536, =0.0.0-nightly-20241120023536, =0.1.16-next.0 Source cves: CVE-2024-53983 Source advisory: MEND:CVE-2024-53983...

CVE-2024-53983

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

CVE-2024-53983: Server-Side Request Forgery (SSRF)

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

CVE-2024-47762

Backstage is an open framework for building developer portals. Configuration supplied through APPCONFIG environment variables, for example APPCONFIGbackendlistenport=7007, where unexpectedly ignoring the visibility defined in configuration schema. This occurred even if the configuration schema...

Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend

Impact Configuration supplied through APPCONFIG environment variables, for example APPCONFIGbackendlistenport=7007, where unexpectedly ignoring the visibility defined in configuration schema. This occurred even if the configuration schema specified that they should have backend or secret...

GHSA-QC4V-XQ2M-65WC Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend

Impact Configuration supplied through APPCONFIG environment variables, for example APPCONFIGbackendlistenport=7007, where unexpectedly ignoring the visibility defined in configuration schema. This occurred even if the configuration schema specified that they should have backend or secret...

CVE-2024-47762: Expected Behavior Violation

Backstage is an open framework for building developer portals. Configuration supplied through APPCONFIG environment variables, for example APPCONFIGbackendlistenport=7007, where unexpectedly ignoring the visibility defined in configuration schema. This occurred even if the configuration schema...

Prototype Pollution

@backstage/plugin-catalog-backend is vulnerable to Prototype Pollution. The vulnerability is caused due to improper user input sanitization in the catalog API, which allows an attacker to interrupt the service using a specially crafted query...

Relative Path Traversal

@backstage/plugin-techdocs-backend is vulnerable to Relative Path Traversal. The vulnerability is caused due to improper validation of file paths, allowing unauthorized access to files in the AWS S3 or GCS storage provider...

@janus-idp/backstage-plugin-keycloak-backend (1.0.0) potentially affected by CVE-2024-45815 via @backstage/plugin-catalog-backend (1.5.1)

@backstage/plugin-catalog-backend NPM version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-catalog-backend and may be impacted: - @janus-idp/backstage-plugin-keycloak-backend 1.0.0 Source cves: CVE-2024-45815 Source advisory:...

CVE-2024-45815

Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. This has been fixed in the "1.26.0"...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20240116021644, <=0.0.0-nightly-20260928023907), @backstage/plugin-catalog-backend-module-aws (>=0.0.0-nightly-20220219022334, <=0.1.2) +26 more potentially affected by CVE-2024-45815 via @backstage/plugin-catalog-backend (>=0.0.0-nightly-20220708025041, <=1.5.1)

@backstage/plugin-catalog-backend NPM version =0.0.0-nightly-20220708025041, =0.0.0-nightly-20240116021644, =0.0.0-nightly-20220219022334, =0.0.0-nightly-20220308022132, =0.0.0-nightly-20220311022539, =0.0.0-nightly-20220531024457, =0.0.0-nightly-20220810023539, =0.0.0-nightly-20220422024928,...

CVE-2024-45816 Storage bucket Directory Traversal in @backstage/plugin-techdocs-backend

Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks...

CVE-2024-45816

Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks...

CVE-2024-46976

Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attack...

CVE-2024-46976: Protection Mechanism Failure

Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attack...

CVE-2024-45816: Relative Path Traversal

Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks...