CVE-2021-43783: Backstage plugin-scaffolder-backend path traversal in fetch:template

CVE-2021-43783 · Severity: low · CVSS 3.1 · Published 2021-12-01

Backstage's scaffolder plugin allows users to create code projects from templates. A malicious actor with write access to templates can inject path traversal sequences to write files to arbitrary locations on the server, or exploit this through user input during template execution. This could lead to arbitrary file writes, potentially compromising the integrity of the scaffolder host and enabling further attacks.

Technologies: Backstage Plugin-Scaffolder-Backend, @backstage/plugin-scaffolder-backend (npm). Vendors: Backstage, npm.

Quick answers

Is CVE-2021-43783 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-43783 being exploited in the wild.
How severe is CVE-2021-43783?
Low severity, with a CVSS score of 3.1, published 1 December 2021.
Which products and versions are affected?
Backstage Plugin-Scaffolder-Backend < 0.15.14; @backstage/plugin-scaffolder-backend (npm) SEMVER:introduced=0,fixed=0.15.14.
Is there a fix for CVE-2021-43783?
Yes. @backstage/plugin-scaffolder-backend (npm): upgrade to 0.15.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-43783 attacked?
It is attacked over the network or with local access.
Am I affected by CVE-2021-43783?
Check whether you run Backstage Plugin-Scaffolder-Backend or @backstage/plugin-scaffolder-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @backstage/plugin-scaffolder-backend (npm): upgrade to 0.15.14 or later
    npm install @backstage/plugin-scaffolder-backend@0.15.14

Technical details

Path traversal vulnerability (CWE-22) in the @backstage/plugin-scaffolder-backend fetch:template action allows arbitrary file writes via manipulated template paths or unsanitized user input. Attackers with write access to registered scaffolder templates can craft payloads that bypass pathname restrictions, writing files to arbitrary locations on the host filesystem. The vulnerability can also be triggered through user input during template execution without template write access, though this method does not grant direct control over file contents unless the template is specifically crafted to allow it. The vulnerability affects versions prior to 0.15.14, which contains the fix.

Affected products

  • Backstage plugin-scaffolder-backend < 0.15.14

Identifiers

  • CVE-2021-43783
  • GHSA-mg3m-f475-28hv

Timeline

  • 2021-11-29: disclosed
  • 2021-12-01: patched: Version 0.15.14 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.