Is CVE-2024-45816 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-45816 being exploited in the wild.

How severe is CVE-2024-45816?

Low severity, with a CVSS score of 3.1, published 17 September 2024.

Which products and versions are affected?

Backstage Plugin-Techdocs-Backend < 1.10.13; @backstage/plugin-techdocs-backend (npm) SEMVER:introduced=0,fixed=1.10.13.

Is there a fix for CVE-2024-45816?

Yes. @backstage/plugin-techdocs-backend (npm): upgrade to 1.10.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-45816 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-45816?

Check whether you run Backstage Plugin-Techdocs-Backend or @backstage/plugin-techdocs-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-45816: Backstage TechDocs directory traversal in storage bucket

Q: Is there a fix for CVE-2024-45816?

Yes. @backstage/plugin-techdocs-backend (npm): upgrade to 1.10.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2024-45816 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2024-45816?

Check whether you run Backstage Plugin-Techdocs-Backend or @backstage/plugin-techdocs-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-45816 · Severity: low · CVSS 3.1 · Published 2024-09-17

Backstage is an open-source framework used to build internal developer portals. A security flaw in the TechDocs backend plugin allows authenticated users to access any file within the underlying cloud storage bucket (AWS S3 or Google Cloud Storage). This could lead to the exposure of sensitive documentation or data not intended for public view and allows users to bypass internal permission controls.

Technologies: Backstage Plugin-Techdocs-Backend, @backstage/plugin-techdocs-backend (npm). Vendors: Backstage, npm.

Quick answers

Is CVE-2024-45816 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-45816 being exploited in the wild.
How severe is CVE-2024-45816?: Low severity, with a CVSS score of 3.1, published 17 September 2024.
Which products and versions are affected?: Backstage Plugin-Techdocs-Backend < 1.10.13; @backstage/plugin-techdocs-backend (npm) SEMVER:introduced=0,fixed=1.10.13.
Is there a fix for CVE-2024-45816?: Yes. @backstage/plugin-techdocs-backend (npm): upgrade to 1.10.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-45816 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-45816?: Check whether you run Backstage Plugin-Techdocs-Backend or @backstage/plugin-techdocs-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@backstage/plugin-techdocs-backend (npm): upgrade to 1.10.13 or later
```
npm install @backstage/plugin-techdocs-backend@1.10.13
```

Technical details

A directory traversal vulnerability (CWE-22/CWE-23) exists in the @backstage/plugin-techdocs-backend package when configured with AWS S3 or Google Cloud Storage (GCS) as the storage provider. The application fails to properly neutralize path sequences, allowing an authenticated attacker to traverse outside the intended directory and access any object within the configured storage bucket. This bypasses Backstage's internal permission checks and can lead to full confidentiality loss of the bucket's contents. The issue is fixed in version 1.10.13.

Affected products

Backstage @backstage/plugin-techdocs-backend < 1.10.13

Identifiers

CVE-2024-45816
GHSA-39v3-f278-vj3g

Timeline

2024-09-17: disclosed
2024-09-17: advisory
2024-09-17: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.