Backstage: Sensitive information exposure in Scaffolder

[ Why it matters ]Priority signals

• Critical severity: CVSS 9.6

[ Description ]Official description

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.

[ Fixes ]Fixes and patches

• @backstage/plugin-scaffolder-backend 3.3.1Fixed version · GitHub Advisories · npm package @backstage/plugin-scaffolder-backend: upgrade to 3.3.1 or later (affected < 3.3.1)
• @backstage/plugin-scaffolder-backend 3.4.1Fixed version · GitHub Advisories · npm package @backstage/plugin-scaffolder-backend: upgrade to 3.4.1 or later (affected >= 3.4.0, < 3.4.1)
• @backstage/plugin-scaffolder-backend 4.0.3Fixed version · GitHub Advisories · npm package @backstage/plugin-scaffolder-backend: upgrade to 4.0.3 or later (affected >= 4.0.0, < 4.0.3)
• @backstage/plugin-scaffolder-backend 4.1.0Fixed version · GitHub Advisories · npm package @backstage/plugin-scaffolder-backend: upgrade to 4.1.0 or later (affected >= 4.0.4, < 4.1.0)
• Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
• Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
• Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
• Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ Packages ]Affected open-source packages

• @backstage/plugin-scaffolder-backend npmAffected < 3.3.1 · fixed in 3.3.1 · GHSA-g2v8-7jhw-pp8p
• @backstage/plugin-scaffolder-backend npmAffected >= 3.4.0, < 3.4.1 · fixed in 3.4.1 · GHSA-g2v8-7jhw-pp8p
• @backstage/plugin-scaffolder-backend npmAffected >= 4.0.0, < 4.0.3 · fixed in 4.0.3 · GHSA-g2v8-7jhw-pp8p
• @backstage/plugin-scaffolder-backend npmAffected >= 4.0.4, < 4.1.0 · fixed in 4.1.0 · GHSA-g2v8-7jhw-pp8p

[ References ]References

• github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5Patch
• github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5Patch
• github.com/backstage/backstage/commit/e262d649981ff99bb01ca7077807ae3e25e85560Patch
• github.com/backstage/backstage/releases/tag/v1.49.6PatchRelease Notes
• github.com/backstage/backstage/releases/tag/v1.50.5PatchRelease Notes
• github.com/backstage/backstage/releases/tag/v1.54.6PatchRelease Notes
• github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8pMitigationVendor Advisory