Junglewise Threat Intelligence

CVE-2021-21297: Node-RED prototype pollution in admin API

CVE-2021-21297 · Severity: low · CVSS 3.1 · Published 2021-02-26

Vendors: Node-RED, npm.

Executive brief

Node-RED is a visual programming platform used to wire together hardware devices and online services. A prototype pollution vulnerability in its admin API allows authenticated attackers to modify core JavaScript object behavior, potentially disrupting the runtime behavior and stability of Node-RED instances and dependent flows.

Technical details

This is a prototype pollution vulnerability (CWE-1321, CWE-915) in Node-RED's admin API that allows an attacker to inject malicious properties into the default JavaScript Object prototype. The vulnerability is triggered via a badly formed request to the admin API and requires authentication to access the editor URL. Successful exploitation can modify the default behavior of the Node-RED runtime, affecting all objects created during runtime. The vulnerability has been patched in version 1.2.8, and a workaround involves restricting access to the editor URL to authorized users only.

Affected products

  • Node-RED Node-RED <1.2.8

Timeline

  • 2021-02-26: disclosed: Advisory published
  • 2021-02-26: patched: Fixed in version 1.2.8

References

Related threats