CVE-2021-32660 TechDocs content sanitization bypass
Attackers can bypass content sanitization in Backstage TechDocs to inject malicious scripts, potentially accessing sensitive data if hosted on the same origin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-32660?
CVE-2021-32660 is a medium-severity cross-site scripting vulnerability in backstage, published on 3 Jun 2021. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of `@backstage/tehdocs-common` prior to 0.6.4, a malicious internal actor is able to upload documentation content with malicious scripts. These scripts would normally be sanitized by the TechDocs frontend, but by tricking a user to visit the content via the TechDocs API, the content sanitazion will be bypassed. If the TechDocs API is hosted on the same origin as the Backstage app or other backend plugins, this may give access to sensitive data. The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store. The vulnerability is patched in the `0.6.4` release of `@backstage/techdocs-common`.
Which versions are affected by CVE-2021-32660?
2 open source packages ship an affected version, including @backstage/techdocs-common. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@backstage/techdocs-common npm | All versions | 0.6.4 |
@backstage/techdocs-common npm | All versions | 0.6.4 |
Products include Linuxfoundation \@Backstage\/Techdocs-Common.
How do I fix CVE-2021-32660?
Upgrade @backstage/techdocs-common to 0.6.4 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-32660 being exploited?
There is no known exploitation of CVE-2021-32660 in the wild and no public exploit code.
Sources
Also known as GHSA-pwhf-39xg-4rxw.