Plugin Catalog Backend Module Aws
Monthly
Backstage deployments prior to 1.54.6 that use Azure Blob Storage or AWS S3 catalog sources can be induced to read catalog descriptors from outside the configured storage boundary - an object-storage path traversal in the cloud storage catalog providers and cloud URL readers. Exploitation requires an authenticated principal with high privileges (CVSS PR:H) who already has permission to create or rename objects in the trusted catalog bucket or container, and who then crafts object names containing dot-path segments (including encoded forms such as %2e%2e or backslash-delimited variants) to escape the intended prefix; the read is limited to locations reachable with the backend's own configured storage credentials, and impact is confidentiality-only (CVSS 3.0, AV:N/AC:H/PR:H/S:C/C:L/I:N/A:N). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; a vendor-released patch is available in 1.54.6.
Backstage deployments prior to 1.54.6 that use Azure Blob Storage or AWS S3 catalog sources can be induced to read catalog descriptors from outside the configured storage boundary - an object-storage path traversal in the cloud storage catalog providers and cloud URL readers. Exploitation requires an authenticated principal with high privileges (CVSS PR:H) who already has permission to create or rename objects in the trusted catalog bucket or container, and who then crafts object names containing dot-path segments (including encoded forms such as %2e%2e or backslash-delimited variants) to escape the intended prefix; the read is limited to locations reachable with the backend's own configured storage credentials, and impact is confidentiality-only (CVSS 3.0, AV:N/AC:H/PR:H/S:C/C:L/I:N/A:N). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; a vendor-released patch is available in 1.54.6.