Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary, potentially exposing backend-host data or internal network resources.
This issue is fixed in versions 1.14.6 and 1.15.4 when pymdown-extensions 10.21.3 or later is also used, normally through mkdocs-techdocs-core 1.7.0 or later.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
backstage:backstage
@backstage:plugin-techdocs-node
References 5
https://github.com/backstage/backstage/security/advisories/GHSA-f7v3-xhm6-w245
https://github.com/backstage/backstage/security/advisories/GHSA-f7v3-xhm6-w245
https://github.com/backstage/backstage/commit/017ace52d9b327ededc6704cf17799c87…
https://github.com/backstage/backstage/commit/017ace52d9b327ededc6704cf17799c875ae0f29
https://github.com/backstage/backstage/commit/2d9de4ca117a529de4b6ed7dfb7aa507c…
https://github.com/backstage/backstage/commit/2d9de4ca117a529de4b6ed7dfb7aa507ca7b3f91
https://github.com/backstage/backstage/releases/tag/v1.50.5
https://github.com/backstage/backstage/releases/tag/v1.50.5
https://github.com/backstage/backstage/releases/tag/v1.54.6
https://github.com/backstage/backstage/releases/tag/v1.54.6