Description
OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/* without authentication and allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
openchoreo backstage-plugins
< 1.0.4affected>= 1.1.0, < 1.1.4affected>= 1.2.0-rc.1, < 1.2.1affected
References
- https://github.com/openchoreo/openchoreo/security/advisories/GHSA-v7qx-mqhq-grvh ↗
- https://github.com/openchoreo/backstage-plugins/pull/709 ↗
- https://github.com/openchoreo/backstage-plugins/pull/712 ↗
- https://github.com/openchoreo/backstage-plugins/pull/713 ↗
- https://github.com/openchoreo/backstage-plugins/pull/716 ↗
- https://github.com/openchoreo/backstage-plugins/commit/114a215689924b917da5fd28c56e679aaccaef07 ↗
- https://github.com/openchoreo/backstage-plugins/commit/dfa3fc8bd1ffef1346442c891e3e3dd54bc26501 ↗
- https://github.com/openchoreo/backstage-plugins/commit/f6df89c15834506902b2f706a9e8fbe1f6ef1474 ↗
- https://github.com/openchoreo/backstage-plugins/commit/fdaceeb737938e830c48a150d5bec24f5f487e52 ↗
- https://github.com/openchoreo/backstage-plugins/releases/tag/v1.0.4 ↗
- https://github.com/openchoreo/backstage-plugins/releases/tag/v1.1.4 ↗
- https://github.com/openchoreo/backstage-plugins/releases/tag/v1.2.1 ↗