// For flags

CVE-2021-41151

Path Traversal in @backstage/plugin-scaffolder-backend

Severity Score

4.9
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a `github:publish:pull-request` action and a particular source path. When the template is executed the sensitive files would be included in the published pull request. This vulnerability is mitigated by the fact that an attacker would need access to create and register templates in the Backstage catalog, and that the attack is very visible given that the exfiltration happens via a pull request. The vulnerability is patched in the `0.15.9` release of `@backstage/plugin-scaffolder-backend`.

Backstage es una plataforma abierta para la construcción de portales para desarrolladores. En las versiones afectadas, un actor malicioso podría leer archivos confidenciales del entorno donde se ejecutan las Tareas de Scaffolder. El ataque es ejecutado al diseñar una plantilla personalizada de Scaffolder con una acción "github:publish:pull-request" y una ruta de origen determinada. Cuando la plantilla es ejecutada, los archivos confidenciales se incluyen en la petición de extracción publicada. Esta vulnerabilidad está mitigada por el hecho de que un atacante necesitaría acceso para crear y registrar plantillas en el catálogo de Backstage, y que el ataque es muy visible dado que la exfiltración ocurre por medio de una petición pull. La vulnerabilidad está parcheada en la versión "0.15.9" de "@backstage/plugin-scaffolder-backend"

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-09-15 CVE Reserved
  • 2021-10-18 CVE Published
  • 2023-05-11 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linuxfoundation
Search vendor "Linuxfoundation"
 Backstage
Search vendor "Linuxfoundation" for product "Backstage"
 >= 0.9.4 < 0.15.9
Search vendor "Linuxfoundation" for product "Backstage" and version " >= 0.9.4 < 0.15.9"
-
Affected