CVE-2024-45816
About
Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks in Backstage. This has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Rainforest analyst review
Backstage's TechDocs backend, when backed by AWS S3 or GCS, lets a request reach content across the entire storage bucket rather than just the intended documentation, so an authenticated user can read anything in the bucket and sidestep Backstage's own permission checks. On a developer portal that bucket may hold more than docs, and the permission bypass means the platform's access model isn't actually enforced at the storage layer.
The requirement for authentication keeps this internal: it's users of the portal, not the open internet, who can exercise it. But Backstage is an internal-developer-platform hub with a broad user base and often a permissive default posture, so 'any authenticated user can read the whole bucket' is a real confidentiality gap — the kind of thing an insider or a compromised employee account quietly exploits.
We approach this as a dependency-version and blast-radius question. The fix lives in a specific package version, so we confirm which of our Backstage deployments use S3/GCS-backed TechDocs and whether they're updated. Alongside that, we'd review what actually lives in those buckets, because the durable lesson is not to co-locate sensitive material with docs in a bucket whose access control this bug shows can be bypassed.
References
Related CVEs
Frequently asked questions
What is CVE-2024-45816?
Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks in Backstage. This has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package.
How severe is CVE-2024-45816?
CVE-2024-45816 carries a CVSS 3.1 base score of 6.5, rated medium. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 65 out of 100, in the elevated band.
How is CVE-2024-45816 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N): attack vector Network, attack complexity Low, privileges required Low, user interaction None. Impact on confidentiality High, integrity None and availability None.
Which products are affected by CVE-2024-45816?
Public advisories list the following as affected: backstage. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2024-45816?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.