Plugin Proxy Backend
Monthly
Improper input validation in Backstage's @backstage/plugin-proxy-backend before 0.6.17 allows an authenticated user to craft a request URL containing path traversal sequences that the proxy forwards to a path outside the configured base path on an already-configured upstream target server. The flaw is bounded: the attacker must already hold an authenticated Backstage session (CVSS vector PR:L, unless an endpoint is deliberately configured with 'dangerously-allow-unauthenticated'), and only hosts that are already registered as proxy endpoints can be reached, so the escape is a redirect within an already-trusted target rather than a route to arbitrary internal systems. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the issue is addressed by vendor-released fixes in @backstage/plugin-proxy-backend 0.6.17 and Backstage release v1.54.6.
Inconsistent credential enforcement in the @backstage/plugin-proxy-backend package (versions 0.5.0 through 0.6.17) lets unauthenticated callers reach nested proxy upstreams that were explicitly configured to require credentials. When an operator defines an overlapping parent proxy path with credentials set to 'dangerously-allow-unauthenticated' and a nested child path under it with credentials set to 'require', the permissive parent exemption is applied to requests matched by the nested route, so the request is forwarded to the protected upstream and may be sent with static upstream credentials configured for that proxy. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) marks this as unauthenticated but high-complexity because exploitation depends on a specific overlapping proxy configuration rather than default settings; no public exploit code has been identified and the issue is not confirmed actively exploited (no CISA KEV listing).
Improper input validation in Backstage's @backstage/plugin-proxy-backend before 0.6.17 allows an authenticated user to craft a request URL containing path traversal sequences that the proxy forwards to a path outside the configured base path on an already-configured upstream target server. The flaw is bounded: the attacker must already hold an authenticated Backstage session (CVSS vector PR:L, unless an endpoint is deliberately configured with 'dangerously-allow-unauthenticated'), and only hosts that are already registered as proxy endpoints can be reached, so the escape is a redirect within an already-trusted target rather than a route to arbitrary internal systems. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the issue is addressed by vendor-released fixes in @backstage/plugin-proxy-backend 0.6.17 and Backstage release v1.54.6.
Inconsistent credential enforcement in the @backstage/plugin-proxy-backend package (versions 0.5.0 through 0.6.17) lets unauthenticated callers reach nested proxy upstreams that were explicitly configured to require credentials. When an operator defines an overlapping parent proxy path with credentials set to 'dangerously-allow-unauthenticated' and a nested child path under it with credentials set to 'require', the permissive parent exemption is applied to requests matched by the nested route, so the request is forwarded to the protected upstream and may be sent with static upstream credentials configured for that proxy. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) marks this as unauthenticated but high-complexity because exploitation depends on a specific overlapping proxy configuration rather than default settings; no public exploit code has been identified and the issue is not confirmed actively exploited (no CISA KEV listing).