Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree handling allows an authenticated user who can register documentation sources to include content from outside the intended documentation boundary.
Depending on deployment, this may expose files readable by the build process. This issue is fixed in version 1.15.4.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 2
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Linuxfoundation Backstage_Plugin-Techdocs-Node
cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*
|
— |
1.15.4
|
|
Linuxfoundation Backstage
cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*
|
— |
1.54.6
|
References 3
https://github.com/backstage/backstage/security/advisories/GHSA-vmqh-7cj9-mvcj
https://github.com/backstage/backstage/security/advisories/GHSA-vmqh-7cj9-mvcj
https://github.com/backstage/backstage/commit/911ca36f10e654c5517da029129230fc0…
https://github.com/backstage/backstage/commit/911ca36f10e654c5517da029129230fc05a4f580
https://github.com/backstage/backstage/releases/tag/v1.54.6
https://github.com/backstage/backstage/releases/tag/v1.54.6