CVE-2021-32661: Script Injection in @backstage/plugin-techdocs
Summary
CVE-2021-32661: Script injection. Affects @backstage/plugin-techdocs versions < 0.9.5. Fixed in 0.9.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-techdocs package is an npm package that provides a plugin for the Backstage framework. It is used for managing and displaying documentation content. The package allows users to upload documentation content, which can be accessed by other users visiting the documentation page. However, a vulnerability in the package allows malicious internal actors to upload documentation content with embedded malicious scripts. This can lead to unauthorized access to sensitive data when other users visit the same documentation page. The impact of this vulnerability can be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has direct access to upload files to that store.
Vulnerability Detail
The vulnerability, identified as CVE-2021-32661, is a script injection vulnerability in the @backstage/plugin-techdocs package. A malicious internal actor can exploit this vulnerability by embedding a script within an object element while uploading documentation content. When other users visit the affected documentation page, the malicious script can execute and potentially gain access to sensitive data. The ability to upload malicious content may be limited by internal code review processes, but if the TechDocs deployment method involves using an object store and the actor has direct upload access, the impact of the vulnerability can be severe.
How To Fix
Minimum fixed version
0.9.5
This is the first release that contains the fix.
npm install @backstage/plugin-techdocs@0.9.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that the TechDocs deployment method does not involve using an object store with direct upload access for documentation content. Additionally, implementing strict code review processes can help prevent the upload of malicious content.
Conclusion
The CVE-2021-32661 vulnerability in the @backstage/plugin-techdocs package allows malicious internal actors to upload documentation content with embedded malicious scripts, potentially leading to unauthorized access to sensitive data. To mitigate this vulnerability, it is recommended to update the package to version 0.9.5 or later. Implementing strict code review processes and avoiding the use of an object store with direct upload access can further reduce the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for @backstage/plugin-techdocs →
FAQ
The vulnerability allows malicious internal actors to upload documentation content with embedded malicious scripts. When other users visit the affected documentation page, the malicious scripts can execute and potentially gain access to sensitive data.
To fix this vulnerability, update the @backstage/plugin-techdocs package to version 0.9.5 or later. This version includes a patch that prevents script injection and mitigates the risk of unauthorized access to sensitive data.
While there is no specific workaround mentioned, users can mitigate the risk by avoiding the use of an object store with direct upload access for documentation content. Implementing strict code review processes can also help prevent the upload of malicious content.
There is no information provided about known exploitation of this vulnerability. However, it is important to update to the latest version of the package to ensure that the vulnerability is mitigated.
For more information, you can open an issue in the Backstage repository on GitHub or visit the Backstage README for links to the chat where you can ask questions or seek assistance.
