Executive brief
Backstage's Scaffolder plugin (used to create new projects from templates) contains a path traversal vulnerability that allows an authenticated attacker to read sensitive files from the environment and exfiltrate them via GitHub pull requests. The attack requires the attacker to have permissions to create and register templates in the Backstage catalog, making it a restricted threat with moderate business impact.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in the @backstage/plugin-scaffolder-backend that affects versions 0.9.4 through 0.15.8. An authenticated attacker can exploit this by crafting a malicious Scaffolder template with a publish:github:pull-request action using a crafted source path that traverses the restricted directory and accesses arbitrary files. The vulnerability requires the attacker to have catalog template registration permissions, and the exfiltration method (via visible pull requests) makes the attack highly observable. The vulnerability is fixed in version 0.15.9 and later.
Affected products
- Backstage plugin-scaffolder-backend 0.9.4 to 0.15.8
Timeline
- 2021-10-16: disclosed: Security advisory published
- 2021-10-19: patched: Fix available in version 0.15.9