GHSA-4jqc-jvh2-pxg9
Suggest an improvement- Source
- https://github.com/advisories/GHSA-4jqc-jvh2-pxg9
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-4jqc-jvh2-pxg9/GHSA-4jqc-jvh2-pxg9.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-4jqc-jvh2-pxg9
- Published
- 2022-06-17T01:11:10Z
- Modified
- 2022-06-17T01:11:10Z
- Summary
- Path traversal for local publishers in TechDocs backend
- Details
-
Impact
A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when
techdocs.publisher.typeis set tolocal.This vulnerability is mitigated by the fact that the Software Catalog must be configured with non-standard field format validators and/or non-standard entity policies.
Patches
Those affected are advised to upgrade to
@backstage/plugin-techdocs-nodeversion1.1.2or higher.Workarounds
If patching or upgrading is not possible, it would be sufficient to update any custom Catalog field format validators and/or custom entity policies to disallow entity names, kinds, and namespaces containing
..For more information
If you have any questions or comments about this advisory:
- Open an issue in the Backstage repository
- Visit our chat, linked to in the Backstage README
- Database specific
{ "cwe_ids": [], "github_reviewed": true, "github_reviewed_at": "2022-06-17T01:11:10Z", "nvd_published_at": null, "severity": "MODERATE" }- References
Affected packages
npm / @backstage/plugin-techdocs-node
Package
- Name
- @backstage/plugin-techdocs-node
- View open source insights on deps.dev
- Purl
- pkg:npm/%40backstage/plugin-techdocs-node
npm / @backstage/techdocs-common
Package
- Name
- @backstage/techdocs-common
- View open source insights on deps.dev
- Purl
- pkg:npm/%40backstage/techdocs-common