Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 1 December 2021.

Which products and versions are affected?

Backstage Scaffolder Backend Plugin < 0.15.14; @backstage/plugin-scaffolder-backend (npm) SEMVER:introduced=0,fixed=0.15.14.

Is there a fix for This vulnerability?

Yes. @backstage/plugin-scaffolder-backend (npm): upgrade to 0.15.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Backstage Scaffolder Backend Plugin or @backstage/plugin-scaffolder-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Backstage Scaffolder Backend remote code execution in v1beta3 templates

Q: Is there a fix for This vulnerability?

Yes. @backstage/plugin-scaffolder-backend (npm): upgrade to 0.15.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run Backstage Scaffolder Backend Plugin or @backstage/plugin-scaffolder-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: info · Published 2021-12-01

Backstage is an open-source framework used to build developer portals. A security flaw in its scaffolding component, which automates the creation of new software projects, could allow an attacker to execute unauthorized commands on the server. This occurs if an attacker can modify the templates used to generate new projects, potentially leading to a full system takeover or data theft.

Technologies: Backstage Scaffolder Backend Plugin, @backstage/plugin-scaffolder-backend (npm). Vendors: Backstage, npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 1 December 2021.
Which products and versions are affected?: Backstage Scaffolder Backend Plugin < 0.15.14; @backstage/plugin-scaffolder-backend (npm) SEMVER:introduced=0,fixed=0.15.14.
Is there a fix for This vulnerability?: Yes. @backstage/plugin-scaffolder-backend (npm): upgrade to 0.15.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Backstage Scaffolder Backend Plugin or @backstage/plugin-scaffolder-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@backstage/plugin-scaffolder-backend (npm): upgrade to 0.15.14 or later
```
npm install @backstage/plugin-scaffolder-backend@0.15.14
```

Technical details

A remote code execution (RCE) vulnerability exists in the @backstage/plugin-scaffolder-backend package due to the underlying templating library's assumption that all templates are trusted. An attacker with write access to a registered scaffolder template can inject malicious code into the template's YAML definition. Because the template execution was not previously sandboxed, this code runs with the privileges of the scaffolder-backend process. The vulnerability is specifically exploitable through the template definition itself rather than user-provided input data. This issue has been mitigated in version 0.15.14 by implementing sandboxing for template code execution.

Affected products

Backstage @backstage/plugin-scaffolder-backend < 0.15.14

Timeline

2021-11-26: advisory: Initial advisory published by maintainers
2021-11-29: patched: Fix released in version 0.15.14
2021-12-01: disclosed: Public disclosure via GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.