Path Traversal in Backstage
CVE-2021-41151
Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a `github:publish:pull-request` action and a particular source path. When the template is executed the sensitive files would be included in the published pull request. This vulnerability is mitigated by the fact that an attacker would need access to create and register templates in the Backstage catalog, and that the attack is very visible given that the exfiltration happens via a pull request. The vulnerability is patched in the `0.15.9` release of `@backstage/plugin-scaffolder-backend`.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.013 (66.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Backstage — versions >=0.9.4, < 0.15.9
- Linuxfoundation Backstage
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-41151?
- CVE-2021-41151 is a medium-severity vulnerability in Backstage, classified under Path Traversal. CVSS score: 6.8/10. Published 2021-10-18.
- How severe is CVE-2021-41151?
- Medium severity. CVSS v3 base score is 6.8 out of 10.