Executive brief
Backstage TechDocs is a documentation hosting platform used to manage and publish technical documentation. A path traversal vulnerability allows an attacker with access to modify the project's mkdocs.yml configuration file to read arbitrary sensitive files from the build environment, exposing them via the TechDocs API. This could lead to exposure of credentials, private keys, or other confidential data stored alongside documentation sources.
Technical details
The vulnerability is a classic path traversal (CWE-22) in the TechDocs documentation builder. By setting a malicious docs_dir path in mkdocs.yml, an attacker can traverse outside the intended documentation directory and access arbitrary files on the build system. The vulnerability requires two preconditions: (1) the attacker must have write access to the mkdocs.yml configuration in the documentation source repository, and (2) they must be able to access the TechDocs backend API to retrieve the exposed files. The patched version 0.6.3 (later updated to 0.6.5) of @backstage/techdocs-common properly sanitizes the docs_dir path to prevent traversal attacks.
Affected products
- Backstage TechDocs < 0.6.5
Timeline
- 2021-06-03: disclosed
- 2021-06-03: patched: Patched in version 0.6.3/0.6.5 of @backstage/techdocs-common