CVE-2024-45816: @backstage/plugin-techdocs-backend storage bucket Directory Traversal vulnerability

September 17, 2024 (updated January 3, 2025)

When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks in Backstage.

References

github.com/advisories/GHSA-39v3-f278-vj3g
github.com/backstage/backstage
github.com/backstage/backstage/security/advisories/GHSA-39v3-f278-vj3g
nvd.nist.gov/vuln/detail/CVE-2024-45816

Code Behaviors & Features

Detect and mitigate CVE-2024-45816 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →