Listen to this Post
The resolveSafeChildPath utility function in @backstage/backend-plugin-api is intended to prevent path traversal attacks by ensuring that file operations remain within a specified base directory. However, it fails to adequately validate symbolic links, particularly symlink chains and dangling symlinks. In symlink chains, multiple symlinks are created where each link points to another, eventually resolving to a target outside the allowed directory. The function only checks the immediate symlink target, not the final resolution, allowing bypass. For example, an attacker creates link1 pointing to link2, and link2 pointing to /etc/passwd; validation of link1 sees link2 as within base, but access follows to /etc/passwd. Dangling symlinks point to non-existent paths outside the base; if later file operations create those paths, the symlinks become active and permit external access. This flaw is exploited through Backstage’s Scaffolder actions, where users can execute template operations involving file writes or reads. By injecting malicious symlinks, an attacker can traverse directories to read sensitive files or write arbitrary data, potentially leading to information disclosure or remote code execution. The function’s use across backend components amplifies the attack surface, making it critical.
Platform: Backstage
Version: Before version 0.1.17
Vulnerability: Path traversal symlinks
Severity: Critical
Date: Not specified
Prediction: Patched v0.1.17
What Undercode Say:
Analytics:
bash commands:
ln -s link2 link1
ln -s /outside link2
ls -l link1
readlink -f link1
Code snippet:
function resolveSafeChildPath(base, child) {
const resolved = path.resolve(base, child);
if (!resolved.startsWith(base)) {
throw new Error(‘Path traversal detected’);
}
return resolved; // Missing symlink chain resolution
}
How Exploit:
Create symlink chains pointing outside allowed directory. Use dangling symlinks later populated. Exploit via Scaffolder actions.
Protection from this CVE:
Upgrade to version 0.1.17. Use containerized environments. Restrict template creation.
Impact:
Unauthorized file access. Potential remote code execution. Information disclosure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
