Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input validation in cloud storage url readers. An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory.
In certain deployment configurations, this could lead to content injection. This issue is fixed in version 0.17.8.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Privileges Required
High
Admin privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
@backstage:backend-defaults
backstage:backstage
References 3
https://github.com/backstage/backstage/security/advisories/GHSA-7649-wm97-w3j3
https://github.com/backstage/backstage/security/advisories/GHSA-7649-wm97-w3j3
https://github.com/backstage/backstage/commit/14e925ce5b905dd8daa64c3009722febd…
https://github.com/backstage/backstage/commit/14e925ce5b905dd8daa64c3009722febda76034c
https://github.com/backstage/backstage/releases/tag/v1.54.6
https://github.com/backstage/backstage/releases/tag/v1.54.6