Backstage Scaffolder Backend Template Secret Logging Vulnerability

A vulnerability exists in the Backstage Scaffolder backend plugin, specifically in versions prior to 2.1.1. The issue arises from duplicate logging of input values in the 'fetch:template' action, which led to improper redaction of some secrets. This vulnerability is only impactful if '${{ secrets.x }}' is passed to 'fetch:template'.

Impact

The vulnerability can result in the unintentional exposure of template secrets in the logs, as some secrets were not properly redacted due to duplicate logging.

Remediation

Users can upgrade to version 2.1.1 of the Backstage Scaffolder backend plugin to address this vulnerability. Alternatively, Template Authors can remove '${{ secrets }}' from being used as an argument to 'fetch:template'.