| Package | Affected versions | Patched versions |
|---|---|---|
| @backstage/plugin-techdocs-node | < 1.1.2 | 1.1.2 |
| @backstage/techdocs-common | < 0.11.16 | 0.11.16 |
A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when techdocs.publisher.type is set to local.
This vulnerability is mitigated by the fact that the Software Catalog must be configured with non-standard field format validators and/or non-standard entity policies.
Those affected are advised to upgrade to @backstage/plugin-techdocs-node version 1.1.2 or higher.
If patching or upgrading is not possible, it would be sufficient to update any custom Catalog field format validators and/or custom entity policies to disallow entity names, kinds, and namespaces containing ..
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free