Executive brief
Node-RED is a visual programming platform used to wire together hardware devices and online services. A prototype pollution vulnerability in its admin API allows authenticated attackers to modify core JavaScript object behavior, potentially disrupting the runtime behavior and stability of Node-RED instances and dependent flows.
Technical details
This is a prototype pollution vulnerability (CWE-1321, CWE-915) in Node-RED's admin API that allows an attacker to inject malicious properties into the default JavaScript Object prototype. The vulnerability is triggered via a badly formed request to the admin API and requires authentication to access the editor URL. Successful exploitation can modify the default behavior of the Node-RED runtime, affecting all objects created during runtime. The vulnerability has been patched in version 1.2.8, and a workaround involves restricting access to the editor URL to authorized users only.
Affected products
- Node-RED Node-RED <1.2.8
Timeline
- 2021-02-26: disclosed: Advisory published
- 2021-02-26: patched: Fixed in version 1.2.8