CVE-2024-53983

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-53983
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-53983.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-53983
Aliases
Published
2024-11-29T18:53:13.289Z
Modified
2025-12-01T19:59:07.784558Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Server-side request forgery in Backstage Scaffolder plugin
Details

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection (SSTI) can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these tokens, unauthorized access to sensitive resources in git can be achieved. The impact is considered medium severity as the Backstage Threat Model recommends restricting access to adding and editing templates in the Backstage Catalog plugin. The issue has been resolved in versions v0.4.12, v0.5.1 and v0.6.1 of the @backstage/plugin-scaffolder-node package. Users are encouraged to upgrade to this version to mitigate the vulnerability. Users are advised to upgrade. Users unable to upgrade may ensure that templates do not change git config.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53983.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ]
}
References

Affected packages

Git / github.com/backstage/backstage

Affected ranges

Type
GIT
Repo
https://github.com/backstage/backstage
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
70b6384c26df22f862351be65f504ca2db02b762
Last affected
54faa6fa8d32da6568ff8cf073328352e7881b2a
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "= 0.5.0"
        },
        {
            "last_affected": "= 0.6.0"
        }
    ]
}

Affected versions

Other

cli-old-cache-watch
hackweek-demo
release-2021-01-07
release-2021-01-08
release-2021-1-7

v0.*

v0.1.0
v0.1.1
v0.1.1-alpha.0
v0.1.1-alpha.1
v0.1.1-alpha.10
v0.1.1-alpha.11
v0.1.1-alpha.12
v0.1.1-alpha.13
v0.1.1-alpha.15
v0.1.1-alpha.16
v0.1.1-alpha.17
v0.1.1-alpha.18
v0.1.1-alpha.19
v0.1.1-alpha.2
v0.1.1-alpha.20
v0.1.1-alpha.21
v0.1.1-alpha.22
v0.1.1-alpha.23
v0.1.1-alpha.24
v0.1.1-alpha.25
v0.1.1-alpha.26
v0.1.1-alpha.3
v0.1.1-alpha.4
v0.1.1-alpha.5
v0.1.1-alpha.6
v0.1.1-alpha.7
v0.1.1-alpha.8
v0.1.1-alpha.9
v0.2.0
v0.3.0
v0.3.1
v0.3.2
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.5.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-53983.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "0.4.12"
            }
        ]
    }
]