Listen to this Post
The vulnerability resides in the Backstage Scaffolder’s failure to properly validate symbolic links created during template execution. When a user with template creation/execution rights runs a Scaffolder action (like `debug:log` or fs:delete) or extracts an archive, the system resolves symlinks before applying path containment checks. An attacker can craft a template that creates a symlink inside the designated workspace, pointing to a sensitive location like `/etc/passwd` or ../../../. Subsequent actions follow this symlink, believing the target is still within the safe workspace boundary. For debug:log, this leads to arbitrary file read as the action logs the symlink’s target content. For fs:delete, it allows deletion of files outside the workspace. Archive extraction utilities similarly fail to sanitize symlinks within uploaded archives, allowing writes to arbitrary paths when the symlink is later resolved during extraction or subsequent file operations.
Platform: Backstage
Version: See patches
Vulnerability: Path Traversal
Severity: Critical
date: 2024-03-19
Prediction: 2024-03-19
What Undercode Say:
Example malicious template step to create symlink
- action: fs:write
id: create-symlink
input:
path: './workspace/mylink'
content: ''
symlink: '/etc/shadow'
Step to exploit debug:log
- action: debug:log
input:
message: 'Reading link: ${{ steps.create-symlink.output.path }}'
// Malicious archive entry structure
{
name: 'malicious-symlink',
type: 'symlink',
linkname: '/root/.ssh/id_rsa'
}
How Exploit:
1. Attacker creates/scaffolds template.
2. Template creates symlink to `/etc/passwd`.
3. Template uses `debug:log` on symlink.
4. Sensitive file content exposed in logs.
Protection from this CVE:
- Upgrade to patched versions.
- Restrict template permissions.
- Use containerized filesystem isolation.
- Audit existing templates.
Impact:
Arbitrary File Read/Write/Delete.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
