CVE-2024-47762

Summary

CVE-2024-47762 affects Backstage, an open framework for building developer portals. The vulnerability stems from the application ignoring the visibility definitions in configuration schema when using the APP_CONFIG_* environment variables. This behavior, which was once intended, now contradicts the configuration system's expected behavior, potentially exposing sensitive configuration details meant for backend processes or secrets. To mitigate the risk, it is recommended to avoid using the APP_CONFIG_ configuration pattern for secrets and instead consider alternative methods, such as environment substitution, offered by Backstage. The issue has been fixed in version 0.3.75 of the @backstage/plugin-app-backend package.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.