Executive brief
Backstage is a platform for building and managing internal developer portals. The authentication backend plugin contains a reflected cross-site scripting (XSS) vulnerability that allows an attacker to trick a user into visiting a malicious URL, potentially exfiltrating access tokens or other sensitive secrets from the user's browser. While default Content Security Policy settings provide some protection, deployments with disabled policies are at risk.
Technical details
This is a reflected XSS vulnerability (CWE-79) in the @backstage/plugin-auth-backend library, caused by improper neutralization of script-related HTML tags in user input. The vulnerability requires user interaction (clicking a malicious link) and affects network-accessible deployments. An attacker can craft a vulnerable URL containing unescaped input that executes arbitrary JavaScript in the victim's browser, allowing token theft or session hijacking. The attack depends on Content Security Policy not being properly enforced. Patches are available in version 0.4.9 and later.
Affected products
- Backstage plugin-auth-backend < 0.4.9
Timeline
- 2021-11-26: disclosed: Vulnerability disclosed via GitHub Security Advisory
- 2021-12-01: patched: Patch released in version 0.4.9