Executive brief
Backstage is an open-source framework used to build developer portals. A security flaw in its scaffolding component, which automates the creation of new software projects, could allow an attacker to execute unauthorized commands on the server. This occurs if an attacker can modify the templates used to generate new projects, potentially leading to a full system takeover or data theft.
Technical details
A remote code execution (RCE) vulnerability exists in the @backstage/plugin-scaffolder-backend package due to the underlying templating library's assumption that all templates are trusted. An attacker with write access to a registered scaffolder template can inject malicious code into the template's YAML definition. Because the template execution was not previously sandboxed, this code runs with the privileges of the scaffolder-backend process. The vulnerability is specifically exploitable through the template definition itself rather than user-provided input data. This issue has been mitigated in version 0.15.14 by implementing sandboxing for template code execution.
Affected products
- Backstage @backstage/plugin-scaffolder-backend < 0.15.14
Timeline
- 2021-11-26: advisory: Initial advisory published by maintainers
- 2021-11-29: patched: Fix released in version 0.15.14
- 2021-12-01: disclosed: Public disclosure via GitHub Advisory Database