PT-2023-20170 · Unknown · @Backstage/Plugin-Catalog-Backend+2
Rugvip
·
Published
2023-02-14
·
Updated
2023-02-23
·
CVE-2023-25571
CVSS v3.1
6.8
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
@backstage/catalog-model versions prior to 1.2.0
@backstage/core-components versions prior to 0.12.4
@backstage/plugin-catalog-backend versions prior to 1.7.2
Description
This issue allows a malicious actor with access to add or modify content in an instance of the Backstage software catalog to inject script URLs in the entities stored in the catalog. If users of the catalog then click on said URLs, that can lead to an XSS attack. The default
Link component from @backstage/core-components version 1.2.0 and greater will now reject javascript: URLs, and there is a global override of window.open to do the same. In addition, the catalog model v0.12.4 and greater as well as the catalog backend v1.7.2 and greater now has additional validation built in that prevents javascript: URLs in known annotations.Recommendations
For
@backstage/catalog-model versions prior to 1.2.0, update to version 1.2.0 or greater.
For @backstage/core-components versions prior to 0.12.4, update to version 0.12.4 or greater.
For @backstage/plugin-catalog-backend versions prior to 1.7.2, update to version 1.7.2 or greater.
As a temporary workaround, consider limiting access to modifying catalog content and requiring code reviews to mitigate this issue.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
@Backstage/Catalog-Model
@Backstage/Core-Components
@Backstage/Plugin-Catalog-Backend