Script injection

Description

A malicious internal actor is able to upload documentation content with malicious scripts. These scripts would normally be sanitized by the TechDocs frontend, but by tricking a user to visit the content via the TechDocs API, the content sanitazion will be bypassed.

Recommendation

Update the @backstage/techdocs-common package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.6.4
• Patched version(s): 0.6.4

References

• GHSA-pwhf-39xg-4rxw
• CVE-2021-32660
• CWE-434
• CWE-77
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• Script injection - @backstage/plugin-techdocs - CVE-2021-32661
• Command Injection in lodash - lodash-es - CVE-2021-23337
• Risk of code injection - CVE-2021-21278
• Command Injection in lodash - lodash-template - CVE-2021-23337

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@backstage/techdocs-common