Security News > 2022 > November > Critical vulnerability in Spotify’s Backstage discovered, patched

A critical unauthenticated remote code execution vulnerability in Spotify's Backstage project has been found and fixed, and developers are advised to take immediate action in their environments.

Oxeye researchers reported the vulnerability through Spotify's bug bounty program, and Spotify rapidly patched the vulnerability and released Backstage version 1.5.1, which fixes the issue.

"Every research project we spin up starts with mapping potential inputs to an application. What caught our attention in this case were Backstage software templates and the potential for template-based attacks," said Daniel Abeles, Head of Research at Oxeye.

"In reviewing how to confine this risk, we noticed that the templating engine could be manipulated to run shell commands by using user-controlled templates with Nunjucks outside of an isolated environment."

Evaluating user-provided strings in a template engine can be dangerous since it exposes the application to such template-based attacks.

"If using a template engine in an application, make sure to choose the right one in relation to security. Robust template engines are extremely useful but might pose a risk to the organization," said Gal Goldshtein, Senior Security Researcher at Oxeye.

News URL

https://www.helpnetsecurity.com/2022/11/15/spotify-backstage-vulnerability/