Snyk Security Database

@backstage/plugin-catalog-backend is a The Backstage backend plugin that provides the Backstage catalog

Affected versions of this package are vulnerable to Directory Traversal via URL normalization inconsistency in CatalogRules.ts, where catalog rules for URL locations are matched against the raw, non-canonical form of a URL target while the actual content is fetched using the canonicalized (dot-segment-resolved) form. An attacker can craft a URL containing percent-encoded dot segments (e.g. %2e%2e) or other encoding tricks that appear to belong to an allowed location scope during rule matching, but resolve to a different, potentially restricted scope when the URL reader fetches the content. This allows the attacker to bypass catalog ingestion rules and register entities from locations that should be denied.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via HMACKey and CryptographyHMACKey, which accept zero-length HMAC secrets. When an application's HS256, HS384, or HS512 verification key resolves to empty - for example, an oct JWK with an empty k value - an attacker can forge JWTs with arbitrary claims that jwt.decode accepts without error.

Affected versions of this package are vulnerable to External Control of File Name or Path via the ClientMessage.validateLocalFileName process. An attacker can access arbitrary files from the client host by controlling the server side of the connection and leveraging standard java.sql calls such as DatabaseMetaData.getImportedKeys, getExportedKeys, or ResultSet.updateRow. This is only exploitable if the server is malicious or compromised, a man-in-the-middle attack is present, and allowLocalInfile is enabled on the client.