Remote Code Execution Discovered in Spotify’s Backstage

A vulnerability in Spotify’s open up-resource, Cloud Native Computing Foundation (CNCF)-incubated job Backstage has been learned that could guide to menace actors executing distant code execution (RCE).

The results arrive from the Oxeye investigation group, who have managed to exploit a digital equipment (VM) sandbox escape through a 3rd-party library named vm2.

“We claimed this RCE vulnerability through Spotify’s bug bounty plan, and the Backstage crew responded speedily by patching it in edition 1.5.1,” Oxeye wrote in an advisory revealed earlier today.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Spotify rated the vulnerability impacting the developer portal making system as critical, with a CVSS rating of 9.8.

“Backstage can keep integration particulars to numerous firm methods, these kinds of as Prometheus, Jira, ElasticSearch, and other folks,” the Oxeye advisory reads.

“Thus, productive exploitation has critical implications for any impacted organization and can compromise all those companies and the info they maintain.”

As soon as they experienced correctly executed the payload regionally, Oxeye then tried to evaluate the possible affect of these types of a vulnerability if exploited in the wild.

“We begun by operating a very simple question for the Backstage favicon hash in Shodan it resulted in additional than 500 Backstage occasions exposed to the internet. We then experimented with to assess how they could be exploited remotely devoid of authenticating to the concentrate on Backstage occasion.”

The security researchers discovered that Backstage was becoming deployed by default with no an authentication system or an authorization mechanism, which permitted visitor obtain.

“Some of the general public Backstage servers available to the internet did not call for any authentication.”

Oxeye then tried out to set up a area Backstage instance that calls for authentication, adhering to tutorial tips initially maintained by the system.

“We ended up with authentication only enforced on the customer side requests flowing to the backend API were being not confirmed for authentication or for authorization.”

In other words, when striving to deliver requests specifically to the backend API server of some internet-exposed scenarios, the researchers uncovered that a handful did not need any kind of authentication or authorization.

“Thus, we concluded the vulnerability could be exploited devoid of authentication on quite a few instances.”

To mitigate the effects of this vulnerability, Oxeye and Spotify have urged businesses and persons to update to the newest version of Backstage.

“Moreover, if you’re utilizing a template motor in your application, make guaranteed you select the proper a single in relation to security,” Oxeye extra. “Robust template engines are particularly useful but might pose a risk to your organization.”

The Oxeye advisory arrives weeks immediately after CloudSEK learned a number of vulnerabilities affecting the Veeam Backup & Replication software.