CVE-2021-32660: Script injection in @backstage/techdocs-common
Summary
CVE-2021-32660: Script injection. Affects @backstage/techdocs-common versions < 0.6.4. Fixed in 0.6.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/techdocs-common package is a part of the Backstage framework, which is an open-source platform for building developer portals. It provides functionality for managing and rendering documentation content. The package is used to sanitize user-uploaded documentation content to prevent script injection and other security vulnerabilities. However, a vulnerability has been discovered that allows a malicious internal actor to bypass the content sanitization by tricking a user to visit the content via the TechDocs API. This can lead to script injection and potential access to sensitive data if the TechDocs API is hosted on the same origin as the Backstage app or other backend plugins.
Vulnerability Detail
The vulnerability (CVE-2021-32660) allows a malicious internal actor to upload documentation content with malicious scripts. Normally, the TechDocs frontend would sanitize these scripts, but visiting the content via the TechDocs API bypasses the content sanitization. If the TechDocs API is hosted on the same origin as the Backstage app or other backend plugins, this can result in access to sensitive data. The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store.
How To Fix
Minimum fixed version
0.6.4
This is the first release that contains the fix.
npm install @backstage/techdocs-common@0.6.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no mentioned workaround for this vulnerability.
Conclusion
In conclusion, the @backstage/techdocs-common package is vulnerable to script injection, allowing a malicious internal actor to upload malicious content and potentially gain access to sensitive data. To fix this vulnerability, it is recommended to update the package to version 0.6.4 or later. No workarounds are available for this vulnerability. For more information and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @backstage/techdocs-common →
FAQ
The vulnerability allows a malicious internal actor to upload documentation content with malicious scripts, bypassing the content sanitization. This can potentially lead to script injection and access to sensitive data if the TechDocs API is hosted on the same origin as the Backstage app or other backend plugins.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation. Simply upload your package-lock.json file to Vulert Playground and it will provide information on any vulnerabilities, including CVE-2021-32660.
No, there are no known workarounds for this vulnerability. It is recommended to update the @backstage/techdocs-common package to the patched version (0.6.4 or later) to mitigate the risk.
For more information, you can open an issue in the Backstage repository (https://github.com/backstage/backstage) or visit the Backstage README for the chat link. The vulnerability has been assigned the identifier GHSA-pwhf-39xg-4rxw in the GitHub Security Advisory Database.
The severity of this vulnerability is rated as MODERATE. The CVSS score for this vulnerability is 6.8.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/techdocs-common.
