Executive brief
Backstage is an open-source framework used to build internal developer portals. A security flaw in the TechDocs backend plugin allows authenticated users to access any file within the underlying cloud storage bucket (AWS S3 or Google Cloud Storage). This could lead to the exposure of sensitive documentation or data not intended for public view and allows users to bypass internal permission controls.
Technical details
A directory traversal vulnerability (CWE-22/CWE-23) exists in the @backstage/plugin-techdocs-backend package when configured with AWS S3 or Google Cloud Storage (GCS) as the storage provider. The application fails to properly neutralize path sequences, allowing an authenticated attacker to traverse outside the intended directory and access any object within the configured storage bucket. This bypasses Backstage's internal permission checks and can lead to full confidentiality loss of the bucket's contents. The issue is fixed in version 1.10.13.
Affected products
- Backstage @backstage/plugin-techdocs-backend < 1.10.13
Timeline
- 2024-09-17: disclosed
- 2024-09-17: advisory
- 2024-09-17: patched