Critical RCE Flaw Reported in Spotify’s Backstage Software Catalog and Developer Platform

Spotify’s Backstage has been found out as susceptible to a serious security flaw that could be exploited to get distant code execution by leveraging a not long ago disclosed bug in a third-occasion module.

The vulnerability (CVSS score: 9.8), at its main, can take gain of a critical sandbox escape in vm2, a well-known JavaScript sandbox library (CVE-2022-36067 aka Sandbreak), that arrived to mild final thirty day period.

“An unauthenticated risk actor can execute arbitrary system instructions on a Backstage application by exploiting a vm2 sandbox escape in the Scaffolder main plugin,” software security organization Oxeye explained in a report shared with The Hacker Information.

Backstage is an open up resource developer portal from Spotify that makes it possible for end users to produce, regulate, and take a look at application factors from a unified “entrance door.” It is really applied by lots of businesses like Netflix, DoorDash, Roku, and Expedia, between other people.

In accordance to Oxeye, the flaw is rooted in a resource referred to as software program templates that can be made use of to generate elements in just Backstage.

Screenshot shows Backstage calling the renderTemplate functionality (that phone calls renderString2) twice in the party of an mistake.

Whilst the template engine utilizes vm2 to mitigate the risk involved with jogging untrusted code, the sandbox escape flaw in the latter produced it attainable to execute arbitrary technique commands outdoors of the security perimeter.

Oxeye said it was in a position to detect far more than 500 publicly-exposed Backstage scenarios on the internet, which could then be remotely weaponized by an adversary without having demanding any authorization.

Subsequent liable disclosure on August 18, the issue was tackled by the undertaking maintainers in variation 1.5.1 produced on August 29, 2022.

“The root of any template-based mostly VM escape is gaining JavaScript execution legal rights inside the template,” the Israeli enterprise mentioned. “By working with ‘logic-less’ template engines these types of as Mustache, you can stay clear of introducing server-side template injection vulnerabilities.”

“Separating the logic from the presentation as a great deal as feasible can considerably lessen your publicity to the most risky template-based mostly assaults,” it additional added.

Uncovered this posting exciting? Adhere to THN on Facebook, Twitter  and LinkedIn to examine much more exclusive information we write-up.

Some parts of this article are sourced from:
thehackernews.com