GHSA-2g8g-63j4-9w3r

Source

https://github.com/advisories/GHSA-2g8g-63j4-9w3r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-2g8g-63j4-9w3r/GHSA-2g8g-63j4-9w3r.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2g8g-63j4-9w3r

Published

2021-12-01T18:29:12Z

Modified

2021-11-29T19:39:57Z

Summary

RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backend

Details

The templating library used by the scaffolder backend assumes that templates are trusted which is an undesired property of the scaffolder-backend. This has now been mitigated by sandboxing the template code execution.

Impact

A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template yaml definition itself and not by user input data.

Patches

This is vulnerability is patched in version 0.15.14 of @backstage/plugin-scaffolder-backend.

For more information

If you have any questions or comments about this advisory:

Open an issue in the Backstage repository
Visit our chat, linked to in Backstage README

Database specific

{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2021-11-29T19:39:57Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / @backstage/plugin-scaffolder-backend

Package

Name: @backstage/plugin-scaffolder-backend; View open source insights on deps.dev
Purl: pkg:npm/%40backstage/plugin-scaffolder-backend

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.15.14

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-2g8g-63j4-9w3r/GHSA-2g8g-63j4-9w3r.json"