Executive brief
Node-RED Dashboard is a visualization and control interface component for the Node-RED automation platform. A cross-site scripting (XSS) vulnerability in the text node allows unauthenticated attackers to inject malicious JavaScript code through the ui_text format handler, potentially enabling theft of session tokens, sensitive information, or account takeover of other users viewing the dashboard.
Technical details
The vulnerability is a reflected/stored cross-site scripting flaw (CWE-79) in the ui_text component's format handler (ui-component-ctrl.js). An attacker can inject arbitrary JavaScript via specially crafted payload using template expressions (e.g., {{constructor.constructor('alert(document.cookie)')()}}) in the text node configuration, which is then executed in the browser context of users viewing the dashboard. The attack requires network access and user interaction (viewing the dashboard) but no prior authentication. The vulnerability affects all versions prior to 3.2.0, which introduced proper output sanitization and is now patched.
Affected products
- Node-RED node-red-dashboard before 3.2.0
Timeline
- 2022-08-05: disclosed: Issue reported on GitHub
- 2022-10-31: advisory: CVE-2022-3783 published
- 2022-11-01: patched: Version 3.2.0 released with fix