Insertion of Sensitive Information into Log File@backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things
Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the NunjucksWorkflowRunner in plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts, where a denied scaffolder action causes the runner to throw a NotAllowedError that includes the full serialized action input in the error message. An authenticated attacker who triggers an unauthorized action can read the complete input object - which may contain secrets, tokens, or other sensitive configuration - from the resulting error response.
How to fix Insertion of Sensitive Information into Log File? Upgrade @backstage/plugin-scaffolder-backend to version 4.1.0 or higher.
| |
Incorrect Authorization@backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things
Affected versions of this package are vulnerable to Incorrect Authorization via SCM scaffolder actions in bitbucketServer.ts and related action files, where the actions fall back to server-side integration credentials when no user-supplied token is provided. An authenticated attacker can trigger SCM operations (repository creation, pull request creation, and similar actions) that execute under the server's privileged integration credentials rather than the user's own credentials, allowing privilege escalation across SCM resources. This affects all SCM provider modules in the scaffolder backend, including Bitbucket Server, Bitbucket Cloud, Azure DevOps, and GitHub.
How to fix Incorrect Authorization? Upgrade @backstage/plugin-scaffolder-backend to version 4.1.0 or higher.
| |
Incorrect Authorization@backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things
Affected versions of this package are vulnerable to Incorrect Authorization via the getAuthorizeConditions function in checkPermissions.ts, which fails to enforce DENY authorization decisions when evaluating scaffolder task read permissions. An authenticated attacker can read scaffolder tasks that they have been explicitly denied access to, because the function only handles CONDITIONAL results and silently allows access when the authorization result is DENY.
How to fix Incorrect Authorization? Upgrade @backstage/plugin-scaffolder-backend to version 4.1.0 or higher.
| |
Information Exposure@backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things
Affected versions of this package are vulnerable to Information Exposure via the task list ordering parameter in the scaffolder backend router, where an authenticated user can supply an arbitrary field name as the order query parameter when listing scaffolder tasks. Because the field value is not validated against an allowlist before being used in a database query, this allows an attacker to probe internal database schema details through error responses or ordering behavior, resulting in unauthorized disclosure of sensitive information.
How to fix Information Exposure? Upgrade @backstage/plugin-scaffolder-backend to version 4.1.0 or higher.
| |
Insertion of Sensitive Information into Log File@backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things
Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the NunjucksWorkflowRunner in NunjucksWorkflowRunner.ts, where secret values interpolated into each iteration contexts are not redacted from task logs. When a workflow step uses the each construct and secrets are present in the template context, the resolved iteration values derived from those secrets are written to the task log in plaintext, allowing an attacker with access to task logs to recover secret material. The fix introduces a pre-iteration render pass without secrets to identify secret-derived values and register them as redactions before any logging occurs.
How to fix Insertion of Sensitive Information into Log File? Upgrade @backstage/plugin-scaffolder-backend to version 4.1.0 or higher.
| |
Insertion of Sensitive Information into Log File@backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things
Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the collectSecretRedactions function in NunjucksWorkflowRunner.ts, which fails to redact secret values from task step logs under certain conditions. The logger is initialised after an early-exit check, meaning secrets are not registered for redaction when a task is cancelled or encounters an error before the logger is created. Additionally, the diffing logic in collectSecretRedactions compares object entries by index rather than by key, causing secret-influenced values to be missed when the rendered object's key order differs between the secrets-present and secrets-absent renders, allowing secret values to appear in plain text in scaffolder task logs.
How to fix Insertion of Sensitive Information into Log File? Upgrade @backstage/plugin-scaffolder-backend to version 4.1.0 or higher.
| |
