Executive brief
Node-RED Dashboard is a dashboard UI for Node-RED automation systems. A cross-site scripting (XSS) vulnerability in the ui_notification node allows authenticated attackers to inject malicious JavaScript that executes in the browsers of other dashboard users, potentially leading to credential theft, session hijacking, or unauthorized actions within the dashboard.
Technical details
The vulnerability is a reflected or stored cross-site scripting (CWE-79) flaw in the ui_notification node component of node-red-dashboard versions prior to 2.17.0. The node accepts and renders raw HTML by default without proper sanitization, allowing attackers with dashboard access to inject arbitrary JavaScript code. The attack requires user interaction (a user must view the dashboard) and low privileges (basic user access to Node-RED). An attacker can execute arbitrary JavaScript in the victim's browser context, potentially stealing sensitive data or session tokens. The fix was released in version 2.17.0.
Affected products
- Node-RED Dashboard < 2.17.0
Timeline
- 2019-07-24: disclosed
- 2019-10-08: advisory
- 2019-10-25: patched: Version 2.17.0 released