Executive brief
Backstage's TechDocs component is a documentation management system that allows users to upload and view documentation. A malicious internal actor can upload documentation with embedded malicious scripts that bypass the security sanitization when accessed via the TechDocs API, potentially exposing sensitive data from the Backstage backend if the API shares the same origin with other components.
Technical details
This is a script injection vulnerability (CWE-77, CWE-434) in Backstage's TechDocs content handling. The TechDocs frontend normally sanitizes documentation content to remove malicious scripts, but this protection is bypassed when content is accessed directly through the TechDocs API endpoint. An authenticated internal actor with documentation upload privileges can inject malicious scripts into the documentation; when a user is tricked into accessing this content via the API (bypassing the sanitizing frontend), the scripts execute in the user's browser context. If the TechDocs API is hosted on the same origin as other Backstage backend plugins, this could allow access to sensitive backend data. The vulnerability was patched in @backstage/techdocs-common version 0.6.4.
Affected products
- Backstage TechDocs Common < 0.6.4
Timeline
- 2021-06-03: disclosed: GitHub advisory published
- 2021-06-03: patched: Fix released in version 0.6.4