Critical vulnerability discovered in Spotify Backstage platform

Share post:

A vulnerability has been discovered in Spotify’s open-source Cloud Native Computing Foundation (CNCF)-incubated project Backstage, that could allow threat actors to execute remote code execution (RCE).

The Oxeye research team discovered a way to escape a virtual machine (VM) sandbox by using a third-party library called vm2.

Oxeye claimed to have identified more than 500 publicly exposed Backstage instances on the internet that could then be remotely controlled by an adversary without authorization.

Spotify rated the vulnerability, which affects the developer portal building platform as critical with a CVSS score of 9.8.

“Backstage can hold integration details to many organization systems such as Prometheus, Jira, ElasticSearch and others,” the Oxeye said.

While it is impossible to know the extent to which cybercriminals are already exploiting vulnerabilities in DevOps platforms, the level of cybersecurity screening has dramatically increased in the wake of a number of high-profile breaches.

The sources for this piece include an article in TheHackerNews.

Featured Tech Jobs



Related articles

Gartner debunks myths undermining cybersecurity success

Henrique Teixeira, Senior Director Analyst at Gartner, and Leigh McMullen, Distinguished VP Analyst at Gartner, highlighted and disproved...

Toyota discloses customer data breach

Toyota has disclosed that customer information from Japan and other countries in Asia and Oceania was publicly available...

Critical Vulnerability found in MOVEit

Progress Software has warned about a critical vulnerability in its popular file-transfer software, MOVEit, which could allow malicious...

Canadian Defence Minister concerned over increasing cyberattacks

Canadian Defence Minister Anita Anand has issued a warning that the country's key infrastructure is more vulnerable to...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways