Executive brief
Backstage TechDocs is a documentation management system used by development teams. A vulnerability in the local publishing backend allows an attacker with catalog registration privileges to write files to arbitrary locations on the server. However, the risk is mitigated by the fact that Backstage's default security policies typically prevent exploitation; only installations with customized field validators or entity policies are at meaningful risk.
Technical details
The vulnerability is a path traversal (CWE-22) issue in the Backstage TechDocs node plugin (@backstage/plugin-techdocs-node) when techdocs.publisher.type is set to local. A malicious actor with the ability to register entities in the Software Catalog can craft entity names, kinds, or namespaces containing path traversal sequences (such as "..") to write files outside the intended techdocs directory on the backend host. Attack preconditions include network access to the Backstage instance and the ability to register catalog entities, which typically requires authentication. The impact is arbitrary file write on the server hosting the techdocs backend, potentially leading to remote code execution or data manipulation. Patches are available in @backstage/plugin-techdocs-node version 1.1.2 and higher, and @backstage/techdocs-common version 0.11.16 and higher. Workarounds involve updating custom field validators and entity policies to reject entity names containing "..".
Affected products
- Backstage @backstage/plugin-techdocs-node < 1.1.2
- Backstage @backstage/techdocs-common < 0.11.16
Timeline
- 2022-06-17: disclosed: Advisory published
- 2022-06-13: patched: Fix merged in commit 429c9f9daa5654dd1b996aa85f7264eb23a2e4fa