Quick answers
- Is CVE-2022-3783 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2022-3783 being exploited in the wild.
- How severe is CVE-2022-3783?
- Low severity, with a CVSS score of 3.1, published 1 November 2022.
- Which products and versions are affected?
- node-red-dashboard (npm) SEMVER:introduced=0,fixed=3.2.0.
- Is there a fix for CVE-2022-3783?
- Yes. node-red-dashboard (npm): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2022-3783 attacked?
- It is attacked over the network.
- Am I affected by CVE-2022-3783?
- Check whether you run node-red-dashboard (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- node-red-dashboard (npm): upgrade to 3.2.0 or later
npm install node-red-dashboard@3.2.0
Technical details
The vulnerability is a reflected/stored cross-site scripting flaw (CWE-79) in the ui_text component's format handler (ui-component-ctrl.js). An attacker can inject arbitrary JavaScript via specially crafted payload using template expressions (e.g., {{constructor.constructor('alert(document.cookie)')()}}) in the text node configuration, which is then executed in the browser context of users viewing the dashboard. The attack requires network access and user interaction (viewing the dashboard) but no prior authentication. The vulnerability affects all versions prior to 3.2.0, which introduced proper output sanitization and is now patched.
Affected products
- Node-RED node-red-dashboard before 3.2.0
Identifiers
- CVE-2022-3783
- GHSA-vrv9-3x3w-ffxw
Timeline
- 2022-08-05: disclosed: Issue reported on GitHub
- 2022-10-31: advisory: CVE-2022-3783 published
- 2022-11-01: patched: Version 3.2.0 released with fix