Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary, potentially exposing backend-host data or internal network resources.
This issue is fixed in versions 1.14.6 and 1.15.4 when pymdown-extensions 10.21.3 or later is also used, normally through mkdocs-techdocs-core 1.7.0 or later.
Характеристики атаки
Способ атаки
По сети
Атака возможна удалённо
Сложность
Низкая
Легко эксплуатировать
Нужны права
Низкие
Нужны базовые права
Участие пользователя
Не требуется
Не нужно действие пользователя
Последствия
Конфиденциальность
Высокое
Полная утечка данных
Целостность
Нет
Нет модификации данных
Доступность
Нет
Нет нарушения работы
Строка CVSS v3.1
Тип уязвимости (CWE)
Уязвимые продукты
backstage:backstage
@backstage:plugin-techdocs-node
Ссылки 5
https://github.com/backstage/backstage/security/advisories/GHSA-f7v3-xhm6-w245
https://github.com/backstage/backstage/security/advisories/GHSA-f7v3-xhm6-w245
https://github.com/backstage/backstage/commit/017ace52d9b327ededc6704cf17799c87…
https://github.com/backstage/backstage/commit/017ace52d9b327ededc6704cf17799c875ae0f29
https://github.com/backstage/backstage/commit/2d9de4ca117a529de4b6ed7dfb7aa507c…
https://github.com/backstage/backstage/commit/2d9de4ca117a529de4b6ed7dfb7aa507ca7b3f91
https://github.com/backstage/backstage/releases/tag/v1.50.5
https://github.com/backstage/backstage/releases/tag/v1.50.5
https://github.com/backstage/backstage/releases/tag/v1.54.6
https://github.com/backstage/backstage/releases/tag/v1.54.6