CVE-2023-25571: Backstage Cross-site scripting in Software Catalog

CVE-2023-25571 · Severity: low · CVSS 3.1 · Published 2023-02-14

Backstage is an open-source platform for building internal developer portals and managing software catalogs. A cross-site scripting (XSS) vulnerability in the Software Catalog component allows authenticated users with content modification permissions to inject malicious JavaScript URLs into catalog entities. When other users click these URLs, their browsers execute arbitrary code, potentially leading to account compromise or data theft.

Technologies: @backstage/plugin-catalog-backend (npm). Vendors: npm.

Quick answers

Is CVE-2023-25571 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-25571 being exploited in the wild.
How severe is CVE-2023-25571?
Low severity, with a CVSS score of 3.1, published 14 February 2023.
Which products and versions are affected?
@backstage/catalog-model (npm) SEMVER:introduced=0,fixed=1.2.0; @backstage/core-components (npm) SEMVER:introduced=0,fixed=0.12.4; @backstage/plugin-catalog-backend (npm) SEMVER:introduced=0,fixed=1.7.2.
Is there a fix for CVE-2023-25571?
Yes. @backstage/catalog-model (npm): upgrade to 1.2.0 or later; @backstage/core-components (npm): upgrade to 0.12.4 or later; @backstage/plugin-catalog-backend (npm): upgrade to 1.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-25571 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2023-25571?
Check whether you run @backstage/catalog-model (npm), @backstage/core-components (npm) or @backstage/plugin-catalog-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @backstage/catalog-model (npm): upgrade to 1.2.0 or later
    npm install @backstage/catalog-model@1.2.0
  • @backstage/core-components (npm): upgrade to 0.12.4 or later
    npm install @backstage/core-components@0.12.4
  • @backstage/plugin-catalog-backend (npm): upgrade to 1.7.2 or later
    npm install @backstage/plugin-catalog-backend@1.7.2

Technical details

This is a stored XSS vulnerability (CWE-79) in the Backstage Software Catalog caused by insufficient validation and sanitization of URLs in catalog entity annotations. An attacker with catalog modification access can inject javascript: protocol URLs into entities and known annotation fields. The vulnerability requires low privileges (authenticated catalog editor) and user interaction (a victim must click the malicious link), but scope changes when exploited, allowing an attacker in the catalog context to access data in the user's session. Patches have been released that add javascript: URL rejection in the Link component from @backstage/core-components (0.12.4+), global window.open override, and backend validation in @backstage/catalog-model (1.2.0+) and @backstage/plugin-catalog-backend (1.7.2+).

Affected products

  • Backstage @backstage/core-components < 0.12.4
  • Backstage @backstage/catalog-model < 1.2.0
  • Backstage @backstage/plugin-catalog-backend < 1.7.2

Identifiers

  • CVE-2023-25571
  • GHSA-7hv8-3fr9-j2hv

Timeline

  • 2023-02-14: disclosed: GHSA-7hv8-3fr9-j2hv published
  • 2023-02-14: patched: Patches released for @backstage/core-components 0.12.4, @backstage/catalog-model 1.2.0, @backstage/plugin-catalog-backend 1.7.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.