CVE-2023-25571 Backstage has XSS Vulnerability in Software Catalog
Attackers with catalog write access can inject malicious scripts via URLs, leading to XSS when users click them.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-25571?
CVE-2023-25571 is a medium-severity cross-site scripting vulnerability in backstage, published on 14 Feb 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Backstage is an open platform for building developer portals. `@backstage/catalog-model` prior to version 1.2.0, `@backstage/core-components` prior to 0.12.4, and `@backstage/plugin-catalog-backend` prior to 1.7.2 are affected by a cross-site scripting vulnerability. This vulnerability allows a malicious actor with access to add or modify content in an instance of the Backstage software catalog to inject script URLs in the entities stored in the catalog. If users of the catalog then click on said URLs, that can lead to an XSS attack.
This vulnerability has been patched in both the frontend and backend implementations. The default `Link` component from `@backstage/core-components` version 1.2.0 and greater will now reject `javascript:` URLs, and there is a global override of `window.open` to do the same. In addition, the catalog model v0.12.4 and greater as well as the catalog backend v1.7.2 and greater now has additional validation built in that prevents `javascript:` URLs in known annotations. As a workaround, the general practice of limiting access to modifying catalog content and requiring code reviews greatly help mitigate this vulnerability.
Which versions are affected by CVE-2023-25571?
6 open source packages ship an affected version, including @backstage/catalog-model, @backstage/core-components and @backstage/plugin-catalog-backend. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
@backstage/catalog-model npm | All versions | 1.2.0 |
@backstage/catalog-model npm | All versions | 1.2.0 |
@backstage/core-components npm | All versions | 0.12.4 |
@backstage/core-components npm | All versions | 0.12.4 |
@backstage/plugin-catalog-backend npm | All versions | 1.7.2 |
@backstage/plugin-catalog-backend npm | All versions | 1.7.2 |
Products include Linuxfoundation Backstage Catalog-Model, Linuxfoundation Backstage Core-Components, Linuxfoundation Backstage Plugin-Catalog-Backend.
How do I fix CVE-2023-25571?
Upgrade @backstage/catalog-model to 1.2.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-25571 being exploited?
There is no known exploitation of CVE-2023-25571 in the wild and no public exploit code.
Sources
Also known as GHSA-7hv8-3fr9-j2hv.