GHSA-4jqc-jvh2-pxg9
GHSA-4jqc-jvh2-pxg9 · Path traversal for local publishers in TechDocs backend
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
### Impact A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when `techdocs.publisher.type` is set to `local`. This vulnerability is mitigated by the fact that the Software Catalog must be configured with non-standard field format validators and/or non-standard entity policies. ### Patches Those affected are advised to upgrade to `@backstage/plugin-techdocs-node` version `1.1.2` or higher. ### Workarounds If patching or upgrading is not possible, it would be sufficient to update any custom Catalog field format validators and/or custom entity policies to disallow entity names, kinds, and namespaces containing `..` <!-- ### References todo: Link to blog post / published report. --> ### For more information If you have any questions or comments about this advisory: - Open an issue in the [Backstage repository](https://github.com/backstage/backstage) - Visit our chat, linked to in the [Backstage README](https://github.com/backstage/backstage)
Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
@backstage/plugin-techdocs-node npm
- Plages de versions concernées
- SEMVER: < 1.1.2
Mettez à jour vers 1.1.2
@backstage/techdocs-common npm
- Plages de versions concernées
- SEMVER: < 0.11.16
Mettez à jour vers 0.11.16