GHSA-4jqc-jvh2-pxg9 Path traversal for local publishers in TechDocs backend
A malicious actor with catalog registration rights can write files to arbitrary paths on the TechDocs backend host when using local publisher configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-4jqc-jvh2-pxg9?
GHSA-4jqc-jvh2-pxg9 is a path traversal vulnerability in @backstage/plugin-techdocs-node, published on 17 Jun 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Impact
A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when techdocs.publisher.type is set to local.
This vulnerability is mitigated by the fact that the Software Catalog must be configured with non-standard field format validators and/or non-standard entity policies.
Patches
Those affected are advised to upgrade to @backstage/plugin-techdocs-node version 1.1.2 or higher.
Workarounds
If patching or upgrading is not possible, it would be sufficient to update any custom Catalog field format validators and/or custom entity policies to disallow entity names, kinds, and namespaces containing ..
<!–
References
todo: Link to blog post / published report. –>
For more information
If you have any questions or comments about this advisory:
- Open an issue in the Backstage repository
- Visit our chat, linked to in the Backstage README
Which versions are affected by GHSA-4jqc-jvh2-pxg9?
4 open source packages ship an affected version, including @backstage/plugin-techdocs-node and @backstage/techdocs-common.
| Package | Affected | Fixed in |
|---|---|---|
@backstage/plugin-techdocs-node npm | All versions | 1.1.2 |
@backstage/plugin-techdocs-node npm | All versions | 1.1.2 |
@backstage/techdocs-common npm | All versions | 0.11.16 |
@backstage/techdocs-common npm | All versions | 0.11.16 |
How do I fix GHSA-4jqc-jvh2-pxg9?
Upgrade @backstage/plugin-techdocs-node to 1.1.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-4jqc-jvh2-pxg9 being exploited?
There is no known exploitation of GHSA-4jqc-jvh2-pxg9 in the wild and no public exploit code.