Penetration Test Report (X41 D-Sec): X41 Backstage Audit 2022 Final Report PUBLIC

PenetrationTestonBackstage
fortheBackstageteam
FinalReportandManagementSummary
2022-08-24
X41 D-SEC GmbH
Krefelder Str. 123
D-52070 Aachen
Amtsgericht Aachen: HRB19989
https://x41-dsec.de/
info@x41-dsec.de
OrganizedbytheOpenSourceTechnologyImprovementFund
PenetrationTestonBackstage fortheBackstageteam
Revision Date Change Author(s)
1 2022-05-25 PreliminaryReport M.Vervier
2 2022-08-18 PublicReport E.Sesterhenn,Y.Klawohn,M.Vervier
X41D-SecGmbH FORPUBLICACTION Page1of63
PenetrationTestonBackstage fortheBackstageteam
Contents
1 ExecutiveSummary 4
2 Introduction 6
2.1 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.2 FindingsOverview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.3 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.4 Coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.5 RecommendedFurtherTests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3 RatingMethodologyforSecurityVulnerabilities 11
3.1 CommonWeaknessEnumeration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
4 Results 13
4.1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4.2 SideFindings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
5 AboutX41D-SecGmbH 62
X41D-SecGmbH FORPUBLICACTION Page2of63
PenetrationTestonBackstage fortheBackstageteam
Dashboard
Target
Customer theBackstageteam
Name Backstage
Type WebApplication
Version v0.70.0(04bb0dd82)and1.4.0(2231987)
Engagement
Type WhiteBoxPenetrationTest
4:LucGommans,Dr.AlexanderPirker,YasarKlawohn,Eric
Consultants
Sesterhenn,andMarkusVervier
EngagementEffort 38person-days,2022-03-03to2022-08-11
Totalissuesfound 12
Critical - 2
High - 2 CWE-287(1)
CWE-303(1) CWE-400(3)
Medium - 5
CWE-799(1)
Low - 3 CWE-613(1)
CWE-200(2)
None - 15
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
Figure1:IssueOverview(l:Severity,r:CWEDistribution)
Not - 4
N/A (Not Applicable) - 0
Partly - 0
Fully - 8
Untested - 0
0 1 2 3 4 5 6 7 8
Figure2:RemediationStatus
X41D-SecGmbH FORPUBLICACTION Page3of63
PenetrationTestonBackstage fortheBackstageteam
1 Executive Summary
In March and April 2022, X41 D-Sec GmbH performed a White Box Penetration Test against
Backstage to identify vulnerabilities and weaknesses in the platform version 0.70.0. In August
2022,X41inspectedthefixesforthediscoveredissuesapplieduntilversion1.4.0.
The test was organized by the Open Source Technology Improvement Fund1, a corporate non-
profitdedicatedtosecuringopensourceapplicationsandinfrastructure.
AtotaloftwelvevulnerabilitieswerediscoveredduringthetestbyX41.Twowereratedascritical,
two were classified as high severity, five as medium, and three as low. Additionally, 15 issues
withoutadirectsecurityimpactwereidentified.
Medium - 5
High - 2
Low - 3
Critical - 2
Figure1.1:IssuesandSeverity
Backstage is a software catalog and development platform that enables teams to quickly ship
high-qualitycode.
1https://ostif.org
X41D-SecGmbH FORPUBLICACTION Page4of63
PenetrationTestonBackstage fortheBackstageteam
In a White Box Penetration Test, the testers receive all available information about the target,
includingsourcecode.Thetestandretestswereperformedbythreeexperiencedsecurityexperts
between2022-03-03and2022-08-11.
The most severe issues are related to the support of multiple authentication providers. These
allowtheloginofusersthatarenotregisteredatBackstagebutonlywiththethirdpartyproviders,
leadingtopotentialauthenticationandauthorizationproblems. Additionally,amisconfiguration
oftheJWTtokenusedforsessionidentificationwasidentified,whichallowstheimpersonation
ofotheruserswithavalidJWTtoken.
Aftertheinitialtest,theissueswerereportedanddiscussedwiththedevelopers. Subsequently,
fixesandmitigationsweredevelopedbytheBackstageteamandverifiedbyX41.
X41 recommends to include the reasoning for issues risk accepted by the Backstage team into
the end user documentation as recommendations or warnings. This will ensure that users of
Backstagecanmakeinformeddecisionstoensureasafeoperation.
InconclusionthecodeofBackstageisconsideredtobeofgoodqualitygiventhecomplexityof
thesystemanditspurpose. TheinteractionwiththeBackstageteamwassmoothandallissues
couldbediscussedopenly.
X41D-SecGmbH FORPUBLICACTION Page5of63
PenetrationTestonBackstage fortheBackstageteam
2 Introduction
X41 reviewed Backstage, setup documentation, and a number of its plugins. The software is
used to build developer portals to create an overview of the different software running in an
organization,integratingwithexternalsystemsforfeatureslikeContinuousIntegration.
CompromisingBackstageinanorganizationwouldallowanattackertocaptureuserauthentica-
tiontokens—astheyuseOAuth—orothermechanismstotriggeractionsonthosesystems.
2.1 Methodology
X41 reviewed Backstage as per the scope defined below. The review was mainly based on a
sourcecodereviewalongsidewithanalysesoflocalinstallationsofthesoftwareontestsystems.
Defaultinstallations,wherethesetupinstructionsarefollowedcorrectly,werecheckedforweak-
nessessuchasunnecessarilybroadpermissionsormissingAPI1 restrictions.
A manual approach for penetration testing and for code review is used by X41. This process is
supportedbytoolssuchasstaticcodeanalyzersandindustrystandardwebapplicationsecurity
tools2.
X41adherestoestablishedstandardsforsourcecodereviewingandpenetrationtesting. These
areinparticulartheCERTSecureCoding3 standardsandtheStudy-APenetrationTestingModel4
oftheGermanFederalOfficeforInformationSecurity.
1ApplicationProgrammingInterface
2https://portswigger.net/burp
3https://wiki.sei.cmu.edu/confluence/display/seccode/SEI+CERT+Coding+Standards
4https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Penetration/penetrati
on_pdf.pdf?__blob=publicationFile&v=1
X41D-SecGmbH FORPUBLICACTION Page6of63
PenetrationTestonBackstage fortheBackstageteam
2.2 Findings Overview
DESCRIPTION SEVERITY REMEDIATION ID REF
NoExpirationClaimforJWTAccessToken MEDIUM FULLY SPBS-CR-22-01 4.1.1
Constant Subject Claim for JWT Access To- HIGH NOT SPBS-CR-22-02 4.1.2
ken
Missing Rate Limiting for Backend Compo- LOW NOT SPBS-CR-22-03 4.1.3
nents
UnauthenticatedDoSSituationDuetoScaf- MEDIUM NOT SPBS-CR-22-04 4.1.4
folderEventStreaming
Information Leakage through Misconfigura- LOW FULLY SPBS-CR-22-05 4.1.5
tionviaTemplates
PotentialInformationLeakagethroughSym- HIGH FULLY SPBS-CR-22-06 4.1.6
linksinRepositories
DoS Situation for catalog-backend Through MEDIUM NOT SPBS-CR-22-08 4.1.7
ProcessingFaultyLocationsandEntities
Authentication of Unknown Users in Auth- CRITICAL FULLY SPBS-CR-22-09 4.1.8
Backend
AccountHijackingDuetoSupportofMultiple CRITICAL FULLY SPBS-CR-22-10 4.1.9
AuthenticationProviders
ExecutionofArbitraryDockerImagesinScaf- MEDIUM FULLY SPBS-CR-22-11 4.1.10
folder
ArbitraryWritestoFileSystemoftechdocs- MEDIUM FULLY SPBS-CR-22-12 4.1.11
backend
DoSSituationDuetomultipleTechdocBuilds LOW FULLY SPBS-CR-22-13 4.1.12
LogInjection NONE NOT SPBS-CR-22-100 4.2.1
MissingArchiveValidationLeadstoPotential NONE FULLY SPBS-CR-22-101 4.2.2
RemoteCodeExecution
CopyingofWorkspacetoArbitraryFileSys- NONE NOT SPBS-CR-22-102 4.2.3
temLocations
No Authentication Required for scaffolder- NONE NOT SPBS-CR-22-103 4.2.4
backend
WrongAgeCheckforServerCertificate NONE NOT SPBS-CR-22-104 4.2.5
NoCheckWhetherFileforLocationSpecEx- NONE FULLY SPBS-CR-22-105 4.2.6
istsonAddingThem
YarnInstallationInstructionsDeprecated NONE NOT SPBS-CR-22-106 4.2.7
nvmInstallationUnverified NONE NOT SPBS-CR-22-107 4.2.8
UseofPrivilegedDockerUser NONE NOT SPBS-CR-22-108 4.2.9
DockerBestPracticesNotApplied NONE NOT SPBS-CR-22-109 4.2.10
ExpiredPublicKeyCleanupOnlyonListing NONE NOT SPBS-CR-22-110 4.2.11
PublicKeys
MissingOperationalSecurityGuidelines NONE NOT SPBS-CR-22-111 4.2.12
Insecure Kubernetes Examples in contrib NONE NOT SPBS-CR-22-112 4.2.13
Folder
RecommendedFirewal