Executive brief
Backstage is an open-source platform for building internal developer portals and managing software catalogs. A cross-site scripting (XSS) vulnerability in the Software Catalog component allows authenticated users with content modification permissions to inject malicious JavaScript URLs into catalog entities. When other users click these URLs, their browsers execute arbitrary code, potentially leading to account compromise or data theft.
Technical details
This is a stored XSS vulnerability (CWE-79) in the Backstage Software Catalog caused by insufficient validation and sanitization of URLs in catalog entity annotations. An attacker with catalog modification access can inject javascript: protocol URLs into entities and known annotation fields. The vulnerability requires low privileges (authenticated catalog editor) and user interaction (a victim must click the malicious link), but scope changes when exploited, allowing an attacker in the catalog context to access data in the user's session. Patches have been released that add javascript: URL rejection in the Link component from @backstage/core-components (0.12.4+), global window.open override, and backend validation in @backstage/catalog-model (1.2.0+) and @backstage/plugin-catalog-backend (1.7.2+).
Affected products
- Backstage @backstage/core-components < 0.12.4
- Backstage @backstage/catalog-model < 1.2.0
- Backstage @backstage/plugin-catalog-backend < 1.7.2
Timeline
- 2023-02-14: disclosed: GHSA-7hv8-3fr9-j2hv published
- 2023-02-14: patched: Patches released for @backstage/core-components 0.12.4, @backstage/catalog-model 1.2.0, @backstage/plugin-catalog-backend 1.7.2