Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths.
This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8.
Характеристики атаки
Способ атаки
По сети
Атака возможна удалённо
Сложность
Низкая
Легко эксплуатировать
Нужны права
Низкие
Нужны базовые права
Участие пользователя
Не требуется
Не нужно действие пользователя
Последствия
Конфиденциальность
Низкое
Частичная утечка данных
Целостность
Высокое
Полная модификация данных
Доступность
Низкое
Частичное нарушение работы
Строка CVSS v3.1
Тип уязвимости (CWE)
Уязвимые продукты
@backstage:backend-defaults
backstage:backstage
Ссылки 5
https://github.com/backstage/backstage/security/advisories/GHSA-cq7v-rfgc-5c7v
https://github.com/backstage/backstage/security/advisories/GHSA-cq7v-rfgc-5c7v
https://github.com/backstage/backstage/commit/40346245c53e1bf26dee56601e95c5c4a…
https://github.com/backstage/backstage/commit/40346245c53e1bf26dee56601e95c5c4ab9cc124
https://github.com/backstage/backstage/commit/bc80ffdafbc92ff7b8c72347eace13cb8…
https://github.com/backstage/backstage/commit/bc80ffdafbc92ff7b8c72347eace13cb8688fd33
https://github.com/backstage/backstage/releases/tag/v1.49.6
https://github.com/backstage/backstage/releases/tag/v1.49.6
https://github.com/backstage/backstage/releases/tag/v1.54.6
https://github.com/backstage/backstage/releases/tag/v1.54.6