Backstage DoS via Catalog API (plugin-catalog-backend) < 1.26.0
CVE-2024-45815 Published on September 17, 2024

Prototype pollution in @backstage/plugin-catalog-backend
Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. This has been fixed in the `1.26.0` release of the `@backstage/plugin-catalog-backend`. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Github Repository NVD

Vulnerability Analysis

CVE-2024-45815 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Weakness Type

What is a Prototype Pollution Vulnerability?

The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

CVE-2024-45815 has been classified to as a Prototype Pollution vulnerability or weakness.


Products Associated with CVE-2024-45815

stack.watch emails you whenever new vulnerabilities are published in Backstage or Linux Foundation Backstage. Just hit a watch button to start following.

Backstage
 
Linux Foundation Backstage
 

Affected Versions

backstage Version < 1.26.0 is affected by CVE-2024-45815

Vulnerable Packages

The following package name and versions may be associated with CVE-2024-45815

Package Manager Vulnerable Package Versions Fixed In
npm @backstage/plugin-catalog-backend < 1.26.0 1.26.0

Exploit Probability

EPSS
0.22%
Percentile
45.03%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.