{"containers": {"cna": {"affected": [{"product": "backstage", "vendor": "backstage", "versions": [{"status": "affected", "version": ">=0.9.4, < 0.15.9"}]}], "descriptions": [{"lang": "en", "value": "Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a `github:publish:pull-request` action and a particular source path. When the template is executed the sensitive files would be included in the published pull request. This vulnerability is mitigated by the fact that an attacker would need access to create and register templates in the Backstage catalog, and that the attack is very visible given that the exfiltration happens via a pull request. The vulnerability is patched in the `0.15.9` release of `@backstage/plugin-scaffolder-backend`."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-10-18T20:30:10", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-pvv8-8fx9-h673"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/6968962c920508eae19a4c1c200fa2c8980a4006"}], "source": {"advisory": "GHSA-pvv8-8fx9-h673", "discovery": "UNKNOWN"}, "title": "Path Traversal in @backstage/plugin-scaffolder-backend", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-41151", "STATE": "PUBLIC", "TITLE": "Path Traversal in @backstage/plugin-scaffolder-backend"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "backstage", "version": {"version_data": [{"version_value": ">=0.9.4, < 0.15.9"}]}}]}, "vendor_name": "backstage"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a `github:publish:pull-request` action and a particular source path. When the template is executed the sensitive files would be included in the published pull request. This vulnerability is mitigated by the fact that an attacker would need access to create and register templates in the Backstage catalog, and that the attack is very visible given that the exfiltration happens via a pull request. The vulnerability is patched in the `0.15.9` release of `@backstage/plugin-scaffolder-backend`."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}]}, "references": {"reference_data": [{"name": "https://github.com/backstage/backstage/security/advisories/GHSA-pvv8-8fx9-h673", "refsource": "CONFIRM", "url": "https://github.com/backstage/backstage/security/advisories/GHSA-pvv8-8fx9-h673"}, {"name": "https://github.com/backstage/backstage/commit/6968962c920508eae19a4c1c200fa2c8980a4006", "refsource": "MISC", "url": "https://github.com/backstage/backstage/commit/6968962c920508eae19a4c1c200fa2c8980a4006"}]}, "source": {"advisory": "GHSA-pvv8-8fx9-h673", "discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-41151", "datePublished": "2021-10-18T20:30:10", "dateReserved": "2021-09-15T00:00:00", "dateUpdated": "2021-10-18T20:30:10", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*", "matchCriteriaId": "078289D5-4B1D-4462-B0C9-A9F3BD7205CC", "versionEndExcluding": "0.15.9", "versionStartIncluding": "0.9.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a `github:publish:pull-request` action and a particular source path. When the template is executed the sensitive files would be included in the published pull request. This vulnerability is mitigated by the fact that an attacker would need access to create and register templates in the Backstage catalog, and that the attack is very visible given that the exfiltration happens via a pull request. The vulnerability is patched in the `0.15.9` release of `@backstage/plugin-scaffolder-backend`."}, {"lang": "es", "value": "Backstage es una plataforma abierta para la construcci\u00f3n de portales para desarrolladores. En las versiones afectadas, un actor malicioso podr\u00eda leer archivos confidenciales del entorno donde se ejecutan las Tareas de Scaffolder. El ataque es ejecutado al dise\u00f1ar una plantilla personalizada de Scaffolder con una acci\u00f3n \"github:publish:pull-request\" y una ruta de origen determinada. Cuando la plantilla es ejecutada, los archivos confidenciales se incluyen en la petici\u00f3n de extracci\u00f3n publicada. Esta vulnerabilidad est\u00e1 mitigada por el hecho de que un atacante necesitar\u00eda acceso para crear y registrar plantillas en el cat\u00e1logo de Backstage, y que el ataque es muy visible dado que la exfiltraci\u00f3n ocurre por medio de una petici\u00f3n pull. La vulnerabilidad est\u00e1 parcheada en la versi\u00f3n \"0.15.9\" de \"@backstage/plugin-scaffolder-backend\""}], "id": "CVE-2021-41151", "lastModified": "2021-10-22T16:09:25.897", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2021-10-18T21:15:07.813", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/backstage/backstage/commit/6968962c920508eae19a4c1c200fa2c8980a4006"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-pvv8-8fx9-h673"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}