Is CVE-2021-3223 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-3223 being exploited in the wild.

How severe is CVE-2021-3223?

Informational severity, with a CVSS score of 7.5, published 29 January 2021.

Which products and versions are affected?

Node-RED Dashboard < 2.26.2; node-red-dashboard (npm) SEMVER:introduced=0,fixed=2.26.2.

Is there a fix for CVE-2021-3223?

Yes. node-red-dashboard (npm): upgrade to 2.26.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-3223 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-3223?

Check whether you run Node-RED Dashboard or node-red-dashboard (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-3223: Node-RED Node-RED-Dashboard path traversal in ui_base.js

Q: Which products and versions are affected?

Node-RED Dashboard < 2.26.2; node-red-dashboard (npm) SEMVER:introduced=0,fixed=2.26.2.

Q: Is there a fix for CVE-2021-3223?

Yes. node-red-dashboard (npm): upgrade to 2.26.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2021-3223 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2021-3223?

Check whether you run Node-RED Dashboard or node-red-dashboard (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-3223 · Severity: info · CVSS 7.5 · Published 2021-01-29

Node-RED-Dashboard is a module used to create live data dashboards for Node-RED applications. A security flaw allows an attacker to bypass folder restrictions and read sensitive files from the server's filesystem, such as configuration files or system credentials. This could lead to the exposure of private data and provide a foothold for further attacks on the hosting infrastructure.

Technologies: Node-RED Dashboard, node-red-dashboard (npm). Vendors: Node-RED, npm.

Quick answers

Is CVE-2021-3223 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-3223 being exploited in the wild.
How severe is CVE-2021-3223?: Informational severity, with a CVSS score of 7.5, published 29 January 2021.
Which products and versions are affected?: Node-RED Dashboard < 2.26.2; node-red-dashboard (npm) SEMVER:introduced=0,fixed=2.26.2.
Is there a fix for CVE-2021-3223?: Yes. node-red-dashboard (npm): upgrade to 2.26.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-3223 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-3223?: Check whether you run Node-RED Dashboard or node-red-dashboard (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

node-red-dashboard (npm): upgrade to 2.26.2 or later
```
npm install node-red-dashboard@2.26.2
```

Technical details

A path traversal vulnerability exists in the ui_base.js component of Node-RED-Dashboard before version 2.26.2. The application matches URLs against the '/ui_base/js/*' pattern and passes the input to path.join without sufficient validation or sanitization. By using encoded traversal sequences like '..%2f', an unauthenticated attacker can escape the intended directory and access sensitive files on the host system, such as 'etc/passwd' or Node-RED's 'settings.js'. The issue was addressed by implementing checks on the served endpoint to prevent directory escape.

Affected products

Node-RED node-red-dashboard < 2.26.2

Identifiers

CVE-2021-3223
GHSA-2hw7-mxvj-m455

Timeline

2021-01-11: disclosed: Issue reported on GitHub
2021-01-11: patched: Version 2.26.2 released with fix
2021-01-26: advisory: NVD published CVE-2021-3223

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.