Vulnerability-Lookup

CVE-2024-53983 (GCVE-0-2024-53983)

Vulnerability from cvelistv5 – Published: 2024-11-29 18:53 – Updated: 2024-12-02 22:16

Title

Server-side request forgery in Backstage Scaffolder plugin

Summary

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection (SSTI) can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these tokens, unauthorized access to sensitive resources in git can be achieved. The impact is considered medium severity as the Backstage Threat Model recommends restricting access to adding and editing templates in the Backstage Catalog plugin. The issue has been resolved in versions `v0.4.12`, `v0.5.1` and `v0.6.1` of the `@backstage/plugin-scaffolder-node` package. Users are encouraged to upgrade to this version to mitigate the vulnerability. Users are advised to upgrade. Users unable to upgrade may ensure that templates do not change git config.

Severity ?

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M

References

URL

Tags

	https://github.com/backstage/backstage/security/a…	x_refsource_CONFIRM
	https://github.com/backstage/backstage/tree/maste…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	backstage	backstage	Affected: < 0.4.12 Affected: = 0.5.0 Affected: = 0.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-53983",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-02T22:15:55.540623Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-02T22:16:09.994Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "backstage",
          "vendor": "backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.4.12"
            },
            {
              "status": "affected",
              "version": "= 0.5.0"
            },
            {
              "status": "affected",
              "version": "= 0.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection (SSTI) can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these tokens, unauthorized access to sensitive resources in git can be achieved. The impact is considered medium severity as the Backstage Threat Model recommends restricting access to adding and editing templates in the Backstage Catalog plugin. The issue has been resolved in versions `v0.4.12`, `v0.5.1` and `v0.6.1` of the `@backstage/plugin-scaffolder-node` package. Users are encouraged to upgrade to this version to mitigate the vulnerability. Users are advised to upgrade. Users unable to upgrade may ensure that templates do not change git config."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-29T18:53:13.289Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/backstage/backstage/security/advisories/GHSA-qmc2-jpr5-7rg9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/backstage/backstage/security/advisories/GHSA-qmc2-jpr5-7rg9"
        },
        {
          "name": "https://github.com/backstage/backstage/tree/master/plugins/scaffolder-node",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/tree/master/plugins/scaffolder-node"
        }
      ],
      "source": {
        "advisory": "GHSA-qmc2-jpr5-7rg9",
        "discovery": "UNKNOWN"
      },
      "title": "Server-side request forgery in Backstage Scaffolder plugin"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-53983",
    "datePublished": "2024-11-29T18:53:13.289Z",
    "dateReserved": "2024-11-25T23:14:36.380Z",
    "dateUpdated": "2024-12-02T22:16:09.994Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-53983\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-02T22:15:55.540623Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-02T22:16:05.527Z\"}}], \"cna\": {\"title\": \"Server-side request forgery in Backstage Scaffolder plugin\", \"source\": {\"advisory\": \"GHSA-qmc2-jpr5-7rg9\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 5.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"backstage\", \"product\": \"backstage\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.4.12\"}, {\"status\": \"affected\", \"version\": \"= 0.5.0\"}, {\"status\": \"affected\", \"version\": \"= 0.6.0\"}]}], \"references\": [{\"url\": \"https://github.com/backstage/backstage/security/advisories/GHSA-qmc2-jpr5-7rg9\", \"name\": \"https://github.com/backstage/backstage/security/advisories/GHSA-qmc2-jpr5-7rg9\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/backstage/backstage/tree/master/plugins/scaffolder-node\", \"name\": \"https://github.com/backstage/backstage/tree/master/plugins/scaffolder-node\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection (SSTI) can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these tokens, unauthorized access to sensitive resources in git can be achieved. The impact is considered medium severity as the Backstage Threat Model recommends restricting access to adding and editing templates in the Backstage Catalog plugin. The issue has been resolved in versions `v0.4.12`, `v0.5.1` and `v0.6.1` of the `@backstage/plugin-scaffolder-node` package. Users are encouraged to upgrade to this version to mitigate the vulnerability. Users are advised to upgrade. Users unable to upgrade may ensure that templates do not change git config.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-918\", \"description\": \"CWE-918: Server-Side Request Forgery (SSRF)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-11-29T18:53:13.289Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-53983\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-02T22:16:09.994Z\", \"dateReserved\": \"2024-11-25T23:14:36.380Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-11-29T18:53:13.289Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-53983

Vulnerability from fkie_nvd - Published: 2024-11-29 19:15 - Updated: 2024-11-29 19:15

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/backstage/backstage/security/advisories/GHSA-qmc2-jpr5-7rg9
	security-advisories@github.com	https://github.com/backstage/backstage/tree/master/plugins/scaffolder-node

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection (SSTI) can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these tokens, unauthorized access to sensitive resources in git can be achieved. The impact is considered medium severity as the Backstage Threat Model recommends restricting access to adding and editing templates in the Backstage Catalog plugin. The issue has been resolved in versions `v0.4.12`, `v0.5.1` and `v0.6.1` of the `@backstage/plugin-scaffolder-node` package. Users are encouraged to upgrade to this version to mitigate the vulnerability. Users are advised to upgrade. Users unable to upgrade may ensure that templates do not change git config."
    },
    {
      "lang": "es",
      "value": "El complemento Backstage Scaffolder contiene tipos y utilidades para crear m\u00f3dulos relacionados con el scaffolder. Se ha identificado una vulnerabilidad en la funcionalidad de plantilla de Backstage Scaffolder, en la que se puede explotar Server-Side Template Injection (SSTI) para realizar una inyecci\u00f3n de configuraci\u00f3n de Git. La vulnerabilidad permite a un atacante capturar tokens de Git privilegiados utilizados por el complemento Backstage Scaffolder. Con estos tokens, se puede lograr acceso no autorizado a recursos confidenciales en Git. El impacto se considera de gravedad media, ya que el modelo de amenazas de Backstage recomienda restringir el acceso para agregar y editar plantillas en el complemento Backstage Catalog. El problema se ha resuelto en las versiones `v0.4.12`, `v0.5.1` y `v0.6.1` del paquete `@backstage/plugin-scaffolder-node`. Se recomienda a los usuarios que actualicen a esta versi\u00f3n para mitigar la vulnerabilidad. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar pueden asegurarse de que las plantillas no cambien la configuraci\u00f3n de Git."
    }
  ],
  "id": "CVE-2024-53983",
  "lastModified": "2024-11-29T19:15:10.137",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-11-29T19:15:10.137",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/backstage/backstage/security/advisories/GHSA-qmc2-jpr5-7rg9"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/backstage/backstage/tree/master/plugins/scaffolder-node"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-QMC2-JPR5-7RG9

Vulnerability from github – Published: 2024-12-02 21:36 – Updated: 2024-12-02 21:36

Summary

Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery

Details

Impact

A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection (SSTI) can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these tokens, unauthorized access to sensitive resources in git can be achieved. The impact is considered medium severity as the Backstage Threat Model recommends restricting access to adding and editing templates in the Backstage Catalog plugin.

Patches

The issue has been resolved in versions v0.4.12, v0.5.1 and v0.6.1 of the @backstage/plugin-scaffolder-node package. Users are encouraged to upgrade to this version to mitigate the vulnerability.

Workarounds

Users can ensure that templates do not change git config.

References

If you have any questions or comments about this advisory:

Open an issue in the Backstage repository Visit our Discord, linked to in Backstage README

Severity ?

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N

4.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-scaffolder-node"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-scaffolder-node"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.5.0"
            },
            {
              "fixed": "0.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.5.0"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-scaffolder-node"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.6.0"
            },
            {
              "fixed": "0.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.6.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2024-53983"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-02T21:36:21Z",
    "nvd_published_at": "2024-11-29T19:15:10Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nA vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection (SSTI) can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these tokens, unauthorized access to sensitive resources in git can be achieved. The impact is considered medium severity as the Backstage Threat Model recommends restricting access to adding and editing templates in the Backstage Catalog plugin.\n\n### Patches\n\nThe issue has been resolved in versions `v0.4.12`, `v0.5.1` and `v0.6.1` of the `@backstage/plugin-scaffolder-node` package. Users are encouraged to upgrade to this version to mitigate the vulnerability.\n\n### Workarounds\n\nUsers can ensure that templates do not change git config.\n\n### References\n\nIf you have any questions or comments about this advisory:\n\nOpen an issue in the [Backstage repository](https://github.com/backstage/backstage)\nVisit our Discord, linked to in [Backstage README](https://github.com/backstage/backstage)",
  "id": "GHSA-qmc2-jpr5-7rg9",
  "modified": "2024-12-02T21:36:21Z",
  "published": "2024-12-02T21:36:21Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/security/advisories/GHSA-qmc2-jpr5-7rg9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53983"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/backstage/backstage"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/tree/master/plugins/scaffolder-node"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-53983 (GCVE-0-2024-53983)

FKIE_CVE-2024-53983

GHSA-QMC2-JPR5-7RG9

Impact

Patches

Workarounds

References

Tags

Sightings

Nomenclature