Executive brief
Node-RED-Dashboard is a module used to create live data dashboards for Node-RED applications. A security flaw allows an attacker to bypass folder restrictions and read sensitive files from the server's filesystem, such as configuration files or system credentials. This could lead to the exposure of private data and provide a foothold for further attacks on the hosting infrastructure.
Technical details
A path traversal vulnerability exists in the ui_base.js component of Node-RED-Dashboard before version 2.26.2. The application matches URLs against the '/ui_base/js/*' pattern and passes the input to path.join without sufficient validation or sanitization. By using encoded traversal sequences like '..%2f', an unauthenticated attacker can escape the intended directory and access sensitive files on the host system, such as 'etc/passwd' or Node-RED's 'settings.js'. The issue was addressed by implementing checks on the served endpoint to prevent directory escape.
Affected products
- Node-RED node-red-dashboard < 2.26.2
Timeline
- 2021-01-11: disclosed: Issue reported on GitHub
- 2021-01-11: patched: Version 2.26.2 released with fix
- 2021-01-26: advisory: NVD published CVE-2021-3223