Backstage Confluence to Markdown Scaffolder Input Validation Vulnerability (CVE-2024-106559)

Vulnerability Overview Vulnerability Name: Improper input validation in Confluence to Markdown scaffolder module Vulnerability ID: GHSA-75qf-886x-5xf2 Severity: Moderate (CVSS v3 base metrics: 6.3 / 10) Publication Date: Aug 28 Scope of Impact Affected Versions: < 0.3.25 Fixed Versions: 0.3.25 Impact Description: Insufficient input validation in the Confluence to Markdown scaffolder module may allow attackers to influence file write operations during template execution. Exploitation requires a Backstage user to run a scaffolder template that processes Confluence content influenced by the attacker. Remediation Patch Version: @backstage/plugin-scaffolder-backend-module-confluence-to-markdown version 0.3.25 Temporary Mitigations: - Restrict Confluence editing access to trusted users. - Review Confluence page content before running scaffolder templates to ensure it originates from trusted pages. References Backstage Scaffolder Documentation Additional Information CVSS v3 base metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: Low - User interaction: Required - Scope: Unchanged - Confidentiality: None - Integrity: High - Availability: Low CVSS v3 vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L CVE ID: CVE-2024-106559 Weaknesses: - CWE-22 - CWE-73 Summary This vulnerability involves an input validation issue in the Confluence to Markdown scaffolder module, which may allow attackers to influence file write operations. It is recommended to upgrade to version 0.3.25 to fix this vulnerability, and to implement temporary measures such as restricting access and reviewing content.

Goal Reached Thanks to every supporter — we hit 100%!

Backstage Confluence to Markdown Scaffolder Input Validation Vulnerability (CVE-2024-106559)

More from this source