Executive brief
Backstage's catalog import function leaks GitLab authentication tokens in error messages displayed on the frontend when a token includes a trailing newline character. An attacker who obtains the exposed token could use it to push malicious code to repositories, delete resources, generate unauthorized credentials, or sign code illegitimately, compromising the integrity of software delivery pipelines.
Technical details
The vulnerability is an information disclosure flaw (CWE-200, CWE-209) in Backstage's GitlabDiscoveryEntityProvider component. When a base64-encoded GitLab token with a newline character is provided in the configuration, input validation fails and the raw token is leaked in error messages sent to the frontend. The flaw occurs during HTTP header construction when node-fetch rejects the malformed header value, and the error handling code fails to sanitize the token from the error output. No authentication or user interaction is required beyond initial deployment; an attacker with access to the frontend can view the leaked token. The vulnerability was fixed in @backstage/backend-app-api version 0.5.9-next.1 and later.
Affected products
- Backstage backend-app-api before 0.5.9-next.1
Timeline
- 2024-01-04: disclosed: Vulnerability published in advisory database
- 2024-01-04: patched: Fix released in @backstage/backend-app-api 0.5.9-next.1