=====================================================================

                             CERT-Renater

                  Note d'Information No. 2023/VULN080

_____________________________________________________________________

DATE                : 16/02/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Backstage versions prior to 
                         1.2.0, 0.12.4, 1.7.2.

=====================================================================
https://github.com/backstage/backstage/security/advisories/GHSA-7hv8-3fr9-j2hv
_____________________________________________________________________


XSS Vulnerability in Software Catalog
Moderate
Rugvip published GHSA-7hv8-3fr9-j2hv

Package
@backstage/catalog-model (npm)

Affected versions
< 1.1.5

Patched versions
1.2.0

@backstage/core-components (npm)
< 0.12.3
0.12.4
@backstage/plugin-catalog-backend (npm)
< 1.7.1
1.7.2


Description

Impact

This vulnerability allows a malicious actor with access to add or modify 
content in an instance of the Backstage software catalog to inject 
script URLs in the entities stored in the catalog. If users of the 
catalog then click on said URLs, that can lead to an XSS attack.


Patches

This vulnerability has been patched in both the frontend and backend 
implementations. The default Link component from 
@backstage/core-components will now reject javascript: URLs, and there 
is a global override of window.open to do the same.

In addition the catalog model as well as the catalog backend now has 
additional validation built in that prevents javascript: URLs in known 
annotations.


Workarounds

The general practice of limiting access to modifying catalog content and 
requiring code reviews greatly helps mitigate this vulnerability.


For more information

If you have any questions or comments about this advisory:

     Open an issue in the Backstage repository
     Visit our chat, linked to in the Backstage README

Severity
Moderate

6.8/ 10

CVSS base metrics

Attack vector
Network

Attack complexity
Low

Privileges required
Low

User interaction
Required

Scope
Changed

Confidentiality
High

Integrity
None

Availability
None

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

CVE ID
CVE-2023-25571

Weaknesses
CWE-84


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================