Executive brief
Backstage TechDocs is a documentation hosting platform used by development teams. A malicious insider can embed malicious scripts within documentation content using object elements, potentially exposing sensitive data to other users who view that documentation. The risk is highest in deployments using object storage where actors have direct file upload access.
Technical details
The vulnerability is a script injection flaw in the TechDocs plugin that fails to sanitize object elements in documentation content. An attacker with upload privileges (either through code review bypass or direct object store access) can embed malicious scripts within object elements that execute in the context of other users' browsers when they view the documentation. The attack requires a malicious internal actor and user interaction (visiting the affected documentation page). The vulnerability is patched in version 0.9.5 of @backstage/plugin-techdocs.
Affected products
- Backstage TechDocs before 0.9.5
Timeline
- 2021-06-03: disclosed
- 2021-06-04: patched: version 0.9.5 released