Executive brief
Node-RED is a visual programming platform used to automate workflows and connect IoT devices and services. A flaw in the flow naming function fails to sanitize user input, allowing attackers to inject malicious JavaScript code that executes in the browser of anyone viewing the affected flow. An attacker with access to create flows could compromise the sessions or data of other users on the same Node-RED instance.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in Node-RED versions prior to 0.20.8, arising from insufficient input sanitization of the name field when creating new flows. An authenticated attacker can inject arbitrary JavaScript in the flow name, which is then executed in the browser of any user viewing that flow (CWE-79). The vulnerability requires authentication to exploit and relies on user interaction (viewing the malicious flow), but the resulting XSS persists across sessions. The attack occurs on the client-side browser context. Node-RED released version 0.20.8 containing the fix; users should upgrade immediately.
Affected products
- Node-RED Node-RED prior to 0.20.8
Timeline
- 2020-01-30: disclosed
- 0.20.8: patched