PT-2021-23925 · Backstage · @Backstage/Plugin-Auth-Backend

Jhaalsp · Published 2021-11-26 · Updated 2021-12-01 · CVE-2021-43776

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: @backstage/plugin-auth-backend versions prior to 0.4.9

Description: The auth-backend plugin in Backstage allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack, potentially allowing the attacker to exfiltrate access tokens or other secrets from the user's browser. The default Content Security Policy (CSP) prevents this attack, but some deployments may have these policies disabled due to incompatibilities.

Recommendations: For versions prior to 0.4.9, update to version 0.4.9 of @backstage/plugin-auth-backend to patch the vulnerability. As a temporary workaround, consider restricting access to the auth-backend plugin until the update is applied. Additionally, review and ensure that Content Security Policy (CSP) is enabled and properly configured to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-43776

GHSA-W7FJ-336R-VW49

Affected Products

@Backstage/Plugin-Auth-Backend

References · 6

• https://osv.dev/vulnerability/GHSA-w7fj-336r-vw49 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43776 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43776 · Vendor Advisory
• https://github.com/backstage/backstage · Note
• https://github.com/backstage/backstage/security/advisories/GHSA-w7fj-336r-vw49 · Note
• https://github.com/backstage/backstage/tree/master/plugins/auth-backend · Note