Path Traversal Vulnerability in @backstage/plugin-techdocs-node
Summary
GHSA-4jqc-jvh2-pxg9: Path traversal for local publishers in TechDocs backend. Affects @backstage/plugin-techdocs-node versions < 1.1.2. Fixed in 1.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-techdocs-node package is an npm package that is part of the Backstage framework. It provides functionality for generating and publishing documentation for software projects. The package allows local publishers to write files to arbitrary paths on the techdocs backend host instance. This vulnerability can be exploited by a malicious actor with the ability to register entities in the Software Catalog when the techdocs.publisher.type is set to local.
Vulnerability Detail
The path traversal vulnerability in @backstage/plugin-techdocs-node allows an attacker to write files to arbitrary paths on the techdocs backend host instance. This can lead to unauthorized access, data leakage, or even remote code execution. The vulnerability is mitigated by the fact that the Software Catalog must be configured with non-standard field format validators and/or non-standard entity policies. However, if these configurations are not in place, an attacker can exploit the vulnerability to compromise the system.
How To Fix
Minimum fixed version
1.1.2
This is the first release that contains the fix.
npm install @backstage/plugin-techdocs-node@1.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not possible, an alternative workaround is to update any custom Catalog field format validators and/or custom entity policies to disallow entity names, kinds, and namespaces containing '..'. This can help prevent the exploitation of the path traversal vulnerability.
Conclusion
The path traversal vulnerability in @backstage/plugin-techdocs-node can be mitigated by upgrading to version 1.1.2 or higher. If upgrading is not possible, updating custom Catalog field format validators and/or custom entity policies can serve as a workaround. It is important to take action to prevent potential unauthorized access, data leakage, or remote code execution. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for @backstage/plugin-techdocs-node →
FAQ
The vulnerability allows an attacker to write files to arbitrary paths on the techdocs backend host instance, potentially leading to unauthorized access, data leakage, or remote code execution.
The recommended fix is to upgrade to version 1.1.2 or higher of the @backstage/plugin-techdocs-node package. This version includes patches that address the path traversal issue.
If upgrading is not possible, you can update custom Catalog field format validators and/or custom entity policies to disallow entity names, kinds, and namespaces containing '..'. This can help mitigate the vulnerability.
There are no known public exploits for this vulnerability at the moment. However, it is still important to apply the recommended fixes or workarounds to prevent potential attacks.
For more information, you can open an issue in the Backstage repository on GitHub or visit the Backstage chat linked in the Backstage README.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/plugin-techdocs-node.
