Executive brief
Backstage's app backend plugin incorrectly exposes environment variable configurations that should be hidden or restricted to backend processes. Administrators setting sensitive configuration like database credentials or API keys via APP_CONFIG_* environment variables risk having these values unintentionally leaked to frontend clients or other unauthorized consumers, compromising the security posture of the deployment.
Technical details
The vulnerability stems from improper handling of APP_CONFIG_* environment variable patterns in @backstage/plugin-app-backend. The configuration system has a schema-based visibility model that designates certain settings as "backend" or "secret" to restrict their exposure, but the APP_CONFIG_* environment variable intake mechanism bypassed these visibility constraints. This allows an attacker with network access to the Backstage instance to retrieve environment-supplied configuration that should remain private, such as backend service credentials or internal port numbers. No authentication or user interaction is required; the exposed configurations are accessible over the network. The vulnerability affects all versions prior to 0.3.75, where the issue has been patched by enforcing visibility schema restrictions on environment variable configuration.
Affected products
- Backstage plugin-app-backend < 0.3.75
Timeline
- 2024-10-03: disclosed: Published as GHSA-qc4v-xq2m-65wc
- 2024-10-03: patched: Resolved in version 0.3.75