Skip to content
Fencer Intel
high —

GHSA-2g8g-63j4-9w3r json

RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backend

published 4y ago modified 4y ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

The templating library used by the scaffolder backend assumes that templates are trusted which is an undesired property of the scaffolder-backend. This has now been mitigated by sandboxing the template code execution.

### Impact A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template yaml definition itself and not by user input data.

### Patches This is vulnerability is patched in version `0.15.14` of `@backstage/plugin-scaffolder-backend`.

### For more information If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage) * Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)

Patch / fix

  • npm @backstage/plugin-scaffolder-backend 0.15.14

Is GHSA-2g8g-63j4-9w3r in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
npm @backstage/plugin-scaffolder-backend
<0.15.14
0.15.14

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.