Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 17 June 2022.

Which products and versions are affected?

@backstage/techdocs-common (npm) SEMVER:introduced=0,fixed=0.11.16.

Is there a fix for This vulnerability?

Yes. @backstage/techdocs-common (npm): upgrade to 0.11.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run @backstage/techdocs-common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Backstage TechDocs path traversal in local publisher

Severity: info · Published 2022-06-17

Backstage TechDocs is a documentation management system used by development teams. A vulnerability in the local publishing backend allows an attacker with catalog registration privileges to write files to arbitrary locations on the server. However, the risk is mitigated by the fact that Backstage's default security policies typically prevent exploitation; only installations with customized field validators or entity policies are at meaningful risk.

Technologies: @backstage/techdocs-common (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 17 June 2022.
Which products and versions are affected?: @backstage/techdocs-common (npm) SEMVER:introduced=0,fixed=0.11.16.
Is there a fix for This vulnerability?: Yes. @backstage/techdocs-common (npm): upgrade to 0.11.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run @backstage/techdocs-common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@backstage/techdocs-common (npm): upgrade to 0.11.16 or later
```
npm install @backstage/techdocs-common@0.11.16
```

Technical details

The vulnerability is a path traversal (CWE-22) issue in the Backstage TechDocs node plugin (@backstage/plugin-techdocs-node) when techdocs.publisher.type is set to local. A malicious actor with the ability to register entities in the Software Catalog can craft entity names, kinds, or namespaces containing path traversal sequences (such as "..") to write files outside the intended techdocs directory on the backend host. Attack preconditions include network access to the Backstage instance and the ability to register catalog entities, which typically requires authentication. The impact is arbitrary file write on the server hosting the techdocs backend, potentially leading to remote code execution or data manipulation. Patches are available in @backstage/plugin-techdocs-node version 1.1.2 and higher, and @backstage/techdocs-common version 0.11.16 and higher. Workarounds involve updating custom field validators and entity policies to reject entity names containing "..".

Affected products

Backstage @backstage/plugin-techdocs-node < 1.1.2
Backstage @backstage/techdocs-common < 0.11.16

Timeline

2022-06-17: disclosed: Advisory published
2022-06-13: patched: Fix merged in commit 429c9f9daa5654dd1b996aa85f7264eb23a2e4fa

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.