Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built.

Patched in @backstage/plugin-techdocs-node, version 1.15.4.

If you cannot upgrade immediately:

- Switch to techdocs.builder: external to isolate TechDocs builds in a container. - Restrict who can register catalog entities with TechDocs annotations. - Audit existing catalog entities for suspicious markdownextensions values in their mkdocs.yml files.

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdownextensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.

Recommended actions to resolve this vulnerability, in priority order.

Upgrade Upgrade npm/@backstage/plugin-techdocs-node to a version that resolves this vulnerability. Fixed in 1.15.4

Upgrade npm/@backstage/plugin-techdocs-node to a version that resolves this vulnerability.

Upgrade Upgrade @backstage/plugin-techdocs-node to a version that resolves this vulnerability. Fixed in 1.15.4

Upgrade @backstage/plugin-techdocs-node to a version that resolves this vulnerability.

Configuration Switch to techdocs.builder: external to isolate TechDocs builds in a container. TechDocs techdocs.builder = external

Switch to techdocs.builder: external to isolate TechDocs builds in a container.

Compensating control Audit existing catalog entities for suspicious markdown_extensions values in their mkdocs.yml files.

Audit existing catalog entities for suspicious markdown_extensions values in their mkdocs.yml files.

Compensating control Restrict who can register catalog entities with TechDocs annotations.

Restrict who can register catalog entities with TechDocs annotations.

Frequently Asked Questions

Who can exploit this issue?

An authenticated user who has permission to register catalog entities can exploit it by supplying a crafted TechDocs mkdocs.yml. Exploitation occurs when TechDocs builds the associated documentation.

Which systems are exposed to command execution?

The TechDocs build host is the system on which arbitrary OS commands execute. Exposure therefore depends on allowing users who can register catalog entities to provide documentation configurations that are subsequently built by TechDocs.

Which versions contain the fix?

The issue is fixed in @backstage/plugin-techdocs-node versions 1.14.6 and 1.15.4. Versions prior to 1.14.6 are identified as affected.