Penetration Test Report (X41 D-Sec): X41 Backstage Audit 2024 Final Report Public

SourceCodeAuditofBackstage
fortheBackstageTeam
FinalReportandManagementSummary
2024-12-16
PUBLIC
X41 D-Sec GmbH
Krefelder Str. 123
D-52070 Aachen
Amtsgericht Aachen: HRB19989
https://x41-dsec.de/
info@x41-dsec.de
OrganizedbytheOpenSourceTechnologyImprovementFund
SourceCodeAuditofBackstage BackstageTeam
Revision Date Change Author(s)
1 2024-09-13 FinalReportandManagement A. Basma, E. Sesterhenn, JM, M.
Summary Vervier,Y.ElBaaj
2 2024-12-16 PublicReport M.Vervier
X41D-SecGmbH PUBLIC Page1of40
SourceCodeAuditofBackstage BackstageTeam
Contents
1 ExecutiveSummary 4
2 Introduction 6
2.1 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.2 FindingsOverview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.3 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.4 Coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.5 RecommendedFurtherTests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3 RatingMethodology 13
3.1 CVSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.2 SeverityMapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.3 CommonWeaknessEnumeration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
4 Results 17
4.1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
4.2 InformationalNotes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
5 AboutX41D-SecGmbH 39
X41D-SecGmbH PUBLIC Page2of40
SourceCodeAuditofBackstage BackstageTeam
Dashboard
Target
Customer BackstageTeam
Name Backstage
Type Framework
Version v1.30.0
Engagement
Type WhiteBoxPenetrationTest
5: AliBasma,EricSesterhenn,JM,MarkusVervier,andYassine
Consultants
ElBaaj
EngagementEffort 24person-days,2024-08-19to2024-09-12
Totalissuesfound 4
Critical - 0
High - 3
CWE-23(1) CWE-287(1)
Medium - 1
Low - 0 CWE-693(1) CWE-1321(1)
None - 7
0 1 2 3 4 5 6 7
Figure1:IssueOverview(l:Severity,r:CWEDistribution)
6
5
4
3
2
1
0
0 1 2 3 4
Exploitability
tcapmI
Figure2:CVSSImpactandExploitabilityDistribution
X41D-SecGmbH PUBLIC Page3of40
SourceCodeAuditofBackstage BackstageTeam
1 Executive Summary
InAugustandSeptember2024,X41D-SecGmbHperformedasecuritysourcecodeauditagainst
Backstagetoidentifyvulnerabilitiesandweaknessesintheframework,followingapreviousre-
viewin2023.TheworkissponsoredbytheOpenSourceTechnologyImprovementFund(OSTIF)
aspartoftheirongoingeffortstosecuretheopensourceworld.
AtotaloffourvulnerabilitieswerediscoveredduringthetestbyX41.Nonewereratedashaving
a critical severity, three as high, one as medium, and none as low. Additionally, seven issues
withoutadirectsecurityimpactwereidentified.
High - 3
Medium - 1
Figure1.1:IssuesandSeverity
Backstageisanopen-sourceframeworkandsoftwarecatalogthatallowsdeveloperstoquickly
ship high-quality code. It is written in TypeScript and extensible via plugins in many ways. As
a framework to develop complex applications, vulnerabilities in the platform itself and its core
pluginscouldhaveawiderscaletechnicalimpactonmanyothersystems.
X41D-SecGmbH PUBLIC Page4of40
SourceCodeAuditofBackstage BackstageTeam
Therefore,X41wastaskedtoperformacodeauditonthecorepartsofBackstage. Inasource
code audit, all information about the system is made available and the code is systematically
inspectedforsecurityvulnerabilitiesthatareexploitableorevenvulnerabilitiesthatarecurrently
shadowed,buthavepotentialtoleadtosecurityissuesinthefuture.Thetestwasperformedby
fiveexperiencedsecurityexpertsbetween2024-08-19and2024-09-12.
ThemostsevereissuediscoveredallowsanattackertotakeoverarbitraryaccountsinBackstage
if multiple authentication providers are enabled. Also a high severity issue allows attackers to
performaDenialofServiceattackor,dependingonthecircumstances,potentiallyachieveSQL
injectionorarbitrarycodeexecution.Anotherissueallowsattackerstofetchfilesoutsideofthe
configuredTechDocswebrootdirectoryfromacloudprovider,leadingtopotentialunintended
exposureofdata. Furthermore,abypassoftheCross-siteScriptingfilterwasalsoidentifiedvia
unfilteredcontenttypes.
X41recommendstoimplementmitigationsagainstprototypepollution.Possiblydangerouscon-
figurations should be marked as such in the documentation, and the Cross-site Scripting filter
shouldbeappliedbasedontheoutput,notonthepredictionofaninput.
Overall, the Backstage framework appears to be on a good security level compared to source
codeofsimilarsizeandcomplexity.Itisvisiblethatitwasdesignedwithsecurityinmind.Never-
theless,duetothecomplexityandhighpaceofthedevelopment,thepotentialforvulnerabilities
beingintroducedisalwayspresent.Itisrecommendedtoperformcodeauditsregularlytodetect
issuesearly.
X41D-SecGmbH PUBLIC Page5of40
SourceCodeAuditofBackstage BackstageTeam
2 Introduction
X41 reviewed Backstage, its setup documentation, and a number of its plugins. The software
isusedtobuilddeveloperportalstocreateanoverviewofthedifferentsoftwarerunninginan
organization,integratingwithexternalsystemsforfeatureslikeContinuousIntegration.
CompromisingaBackstageinstancewouldallowanattackertogainsensitiveinformationabout
anorganization’sdigitalassets,suchasthesourcecodeordeploymentconfigurationsofsoftware
components.
2.1 Methodology
X41reviewedBackstageasdefinedinthescopebelow.Thereviewwasmainlybasedonasource
codereviewalongsideanalysesoflocalinstallationsofthesoftwareontestsystems.
A manual approach for penetration tests and for code reviews is used by X41. This process is
supportedbytoolssuchasstaticcodeanalyzersandindustrystandardwebapplicationsecurity
tools1.
X41adherestoestablishedstandardsforsourcecodereviewingandpenetrationtesting. These
areinparticulartheCERTSecureCoding2 standardsandtheStudy-APenetrationTestingModel3
oftheGermanFederalOfficeforInformationSecurity.
Inaninitial, informalworkshopregardingthedesignandarchitectureoftheapplicationabasic
threatmodeliscreated.Thisisusedtoexplorethesourcecodeforinterestingattacksurfaceand
codepaths. Thesearethenauditedmanuallyandwiththehelpoftoolssuchasstaticanalyzers
andfuzzers.TheidentifiedissuesaredocumentedandcanbeusedinaGAPanalysistohighlight
changestopreviousaudits.
1https://portswigger.net/burp
2https://wiki.sei.cmu.edu/confluence/display/seccode/SEI+CERT+Coding+Standards
3https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Penetration/penetrati
on_pdf.pdf?__blob=publicationFile&v=1
X41D-SecGmbH PUBLIC Page6of40
SourceCodeAuditofBackstage BackstageTeam
2.2 Findings Overview
DESCRIPTION SEVERITY ID REF
PossibleAccountHijackingViaOAuthWhenUsingBuilt-in HIGH BS-CR-24-01 4.1.1
BackstageResolvers
Server-SidePrototypePollutionviaFiltersRequestParameter HIGH BS-CR-24-02 4.1.2
CircumventionofXSSProtection MEDIUM BS-CR-24-03 4.1.3
DirectoryTraversalinTechDocs HIGH BS-CR-24-04 4.1.4
AssessingCSRFRisksinGraphQLContentTypeHandling NONE BS-CR-24-100 4.2.1
PathDisclosure NONE BS-CR-24-101 4.2.2
VulnerableNode.jsModules NONE BS-CR-24-102 4.2.3
ExpressResponseswithoutExplicitContent-Type NONE BS-CR-24-103 4.2.4
LocalFilePathResolution NONE BS-CR-24-104 4.2.5
LowercasingEmailsinAWSAuth NONE BS-CR-24-105 4.2.6
DependencyConflictsduringBackstageTechDocsPluginIn- NONE BS-CR-24-106 4.2.7
stallation
Table2.1:Security-RelevantFindings
X41D-SecGmbH PUBLIC Page7of40
SourceCodeAuditofBackstage BackstageTeam
2.3 Scope
Thescopeofthisauditcoveredthebackstagesourcecodeversionv1.30.0asidentifiedbycom-
mit821f065ee9dc781de74c1cfa7ce38b751f1e35b24 from2024-08-20.
ThetargetofthescopeincludedeverythingfromX41’spreviousauditofBackstage5:
• Backstagecore
• plugins/auth-backend
• plugins/search-backend
• plugins/catalog-backend
• plugins/scaffolder-backend
• TechDocs,consistingof:
– plugins/techdocs
– plugins/techdocs-backend
– packages/techdocs-common
Inadditiontothepreviousscope,theitemslistedbelowwereinscope:
• Permissionsplugin6
• ServicetoServiceAuth7
• Newbackendsystem8
• P