CVE Vulnerability Catalog

Backstage before version 0.6.17 in the @backstage/plugin-proxy-backend package has improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to a path outside the configured base path on the target server. This is limited to target servers already configured as proxy endpoints and requires Backstage authentication by default.

Backstage before version 2.2.4 in the @backstage/plugin-techdocs-backend package has improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure.

Backstage before version 2.2.4 in the @backstage/plugin-techdocs-backend package has improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider (S3, GCS, etc.) and the permission framework enabled. Instances that do not use the permission framework are unaffected, since TechDocs content is visible to all authenticated users by design.

The @backstage/plugin-auth-backend-module-oidc-provider package before version 0.4.20 has improper authentication in the OIDC provider. Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity.

The @backstage/plugin-kubernetes-backend package in Backstage before 0.21.10 is affected by an unsupported catalog cluster authentication mode in the Kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint.

The @backstage/plugin-scaffolder-backend-module-bitbucket-cloud before 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server before 0.2.25 do not sufficiently validate filesystem paths in Bitbucket pull-request Scaffolder actions. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area.

Backstage before version 0.8.7 in the @backstage/plugin-catalog-backend-module-gitlab package has improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticated user.

Backstage prior to 1.54.6 does not consistently enforce credential boundaries in scaffolder source-control actions. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.

In @backstage/plugin-scaffolder-backend prior to 4.1.0, incorrect authorization in scaffolder task listing allows an authenticated internal user to view metadata for tasks outside the intended visibility. Stored task secrets are not included, and no integrity or availability impact was identified. Fixed in version 4.1.0.

In @backstage/plugin-auth-node from 0.3.0 to 0.6.15 and 0.7.5, explicit negative email verification was not consistently honored during shared OAuth profile normalization. In affected configurations, a user may assume another catalog identity and obtain its associated access and permissions. Fixed in versions 0.6.15 and 0.7.5.

The @backstage/plugin-scaffolder-backend-module-sentry package from 0.3.0 until 0.3.8 has improper input validation in Sentry scaffolder actions. An authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials.

In @backstage/plugin-catalog-backend-module-bitbucket-server from 0.4.0 to 0.5.15, inconsistent repository filtering in Bitbucket Server catalog event updates may allow ingestion of locations from repositories excluded by filters. Fixed in version 0.5.15.

In @backstage/plugin-auth-backend-module-cloudflare-access-provider from 0.1.0 to 0.5.0, insufficient audience validation in the Cloudflare Access auth provider allows a user with a valid token for another Access application to authenticate to Backstage. Fixed in version 0.5.0.

In @backstage/plugin-proxy-backend from 0.5.0 to 0.6.18, inconsistent credential enforcement for overlapping proxy routes allows an unauthenticated caller to reach a nested upstream. Fixed in version 0.6.18.

The @backstage/plugin-techdocs-node package from 0.11.12 until 1.14.7 and 1.15.5 has improper validation of mkdocs plugin configuration in TechDocs. An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment.

A heap-based buffer overflow exists in GIMP's DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can overflow 32-bit arithmetic, causing the allocated buffer to be too small for the pixel data written through GEGL. This may lead to heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.

In Amazon Bedrock AgentCore Starter Toolkit before 0.3.14, server-side request forgery in OpenAPI schema processing of the agent import functionality might allow an authenticated remote actor to cause arbitrary outbound requests and read arbitrary local files. Fixed in version 0.3.14; migration to @aws/agentcore is recommended.

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values incorporated into generated Python source without safe literal encoding.

In the optional Amazon Q Business Lambda hook sample (q-business-lambda-hook) available with QnABot on AWS versions 7.0.0 through 7.4.5, an authorization bypass through a user-controlled key might allow an authenticated remote user to read arbitrary S3 objects. Fixed in version 7.4.6, but requires redeployment of the hook stack.

In SSSD (System Security Services Daemon), a flaw exists where pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing unbounded memory consumption, potentially leading to DoS.