Plugin Scaffolder Backend Module Bitbucket Server
Monthly
Path traversal in the Backstage Scaffolder Bitbucket pull-request publish actions allows an authenticated user who can execute an eligible template and influence an allowlisted Bitbucket repository to write files outside the expected working area, potentially compromising backend confidentiality, integrity, and availability. Affected are @backstage/plugin-scaffolder-backend-module-bitbucket-cloud before 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server before 0.2.25 (shipped with Backstage before the v1.54.6 release). Exploitation requires an authenticated account with template-execution privileges, control over the contents of a repository already present in the Bitbucket allowlist, and the source-branch creation flow to be exercised, which is why the assessed vector carries high attack complexity (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, score 8.5); this is not reachable by an anonymous remote attacker on a default install, and no public exploit code has been identified at time of analysis.
An authenticated Backstage user who can run scaffolder templates can invoke built-in source-control actions (GitHub, GitLab, Azure DevOps, Bitbucket Cloud, Bitbucket Server) without supplying a personal SCM token, causing those actions to fall back to shared integration credentials and perform repository operations with broader privileges than the invoking user holds. The flaw affects deployments on Backstage versions prior to 1.54.6 that have SCM integration credentials configured; custom actions and SCM readers that do not accept a user-token input are unaffected. Exploitation requires the PR:L (authenticated) precondition and offers limited confidentiality and integrity impact with scope change, and no public exploit code has been identified at time of analysis.
Path traversal in the Backstage Scaffolder Bitbucket pull-request publish actions allows an authenticated user who can execute an eligible template and influence an allowlisted Bitbucket repository to write files outside the expected working area, potentially compromising backend confidentiality, integrity, and availability. Affected are @backstage/plugin-scaffolder-backend-module-bitbucket-cloud before 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server before 0.2.25 (shipped with Backstage before the v1.54.6 release). Exploitation requires an authenticated account with template-execution privileges, control over the contents of a repository already present in the Bitbucket allowlist, and the source-branch creation flow to be exercised, which is why the assessed vector carries high attack complexity (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, score 8.5); this is not reachable by an anonymous remote attacker on a default install, and no public exploit code has been identified at time of analysis.
An authenticated Backstage user who can run scaffolder templates can invoke built-in source-control actions (GitHub, GitLab, Azure DevOps, Bitbucket Cloud, Bitbucket Server) without supplying a personal SCM token, causing those actions to fall back to shared integration credentials and perform repository operations with broader privileges than the invoking user holds. The flaw affects deployments on Backstage versions prior to 1.54.6 that have SCM integration credentials configured; custom actions and SCM readers that do not accept a user-token input are unaffected. Exploitation requires the PR:L (authenticated) precondition and offers limited confidentiality and integrity impact with scope change, and no public exploit code has been identified at time of analysis.