Is CVE-2021-32660 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-32660 being exploited in the wild.

How severe is CVE-2021-32660?

Low severity, with a CVSS score of 3.1, published 4 June 2021.

Which products and versions are affected?

Backstage TechDocs Common < 0.6.4; @backstage/techdocs-common (npm) SEMVER:introduced=0,fixed=0.6.4.

Is there a fix for CVE-2021-32660?

Yes. @backstage/techdocs-common (npm): upgrade to 0.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-32660 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-32660?

Check whether you run Backstage TechDocs Common or @backstage/techdocs-common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-32660: Backstage TechDocs script injection in API

Q: Is there a fix for CVE-2021-32660?

Yes. @backstage/techdocs-common (npm): upgrade to 0.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2021-32660 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2021-32660?

Check whether you run Backstage TechDocs Common or @backstage/techdocs-common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-32660 · Severity: low · CVSS 3.1 · Published 2021-06-04

Backstage's TechDocs component is a documentation management system that allows users to upload and view documentation. A malicious internal actor can upload documentation with embedded malicious scripts that bypass the security sanitization when accessed via the TechDocs API, potentially exposing sensitive data from the Backstage backend if the API shares the same origin with other components.

Technologies: @backstage/techdocs-common (npm). Vendors: Backstage, npm.

Quick answers

Is CVE-2021-32660 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-32660 being exploited in the wild.
How severe is CVE-2021-32660?: Low severity, with a CVSS score of 3.1, published 4 June 2021.
Which products and versions are affected?: Backstage TechDocs Common < 0.6.4; @backstage/techdocs-common (npm) SEMVER:introduced=0,fixed=0.6.4.
Is there a fix for CVE-2021-32660?: Yes. @backstage/techdocs-common (npm): upgrade to 0.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-32660 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-32660?: Check whether you run Backstage TechDocs Common or @backstage/techdocs-common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@backstage/techdocs-common (npm): upgrade to 0.6.4 or later
```
npm install @backstage/techdocs-common@0.6.4
```

Technical details

This is a script injection vulnerability (CWE-77, CWE-434) in Backstage's TechDocs content handling. The TechDocs frontend normally sanitizes documentation content to remove malicious scripts, but this protection is bypassed when content is accessed directly through the TechDocs API endpoint. An authenticated internal actor with documentation upload privileges can inject malicious scripts into the documentation; when a user is tricked into accessing this content via the API (bypassing the sanitizing frontend), the scripts execute in the user's browser context. If the TechDocs API is hosted on the same origin as other Backstage backend plugins, this could allow access to sensitive backend data. The vulnerability was patched in @backstage/techdocs-common version 0.6.4.

Affected products

Backstage TechDocs Common < 0.6.4

Identifiers

CVE-2021-32660
GHSA-pwhf-39xg-4rxw

Timeline

2021-06-03: disclosed: GitHub advisory published
2021-06-03: patched: Fix released in version 0.6.4

References

https://github.com/backstage/backstage/security/advisories/GHSA-pwhf-39xg-4rxw

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.