CVE-2021-21298: Path traversal in Node-Red
Summary
CVE-2021-21298: Path traversal in Node-Red. Affects @node-red/runtime versions < 1.2.8. Fixed in 1.2.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-RED is an open-source flow-based programming tool that allows users to create applications by wiring together hardware devices, APIs, and online services. It provides a web-based editor for creating and managing flows. The Projects feature in Node-RED allows users to version control their flows and collaborate with others. However, a vulnerability in the Projects API allows for arbitrary path traversal, potentially granting unauthorized access to sensitive files.
Vulnerability Detail
The vulnerability in Node-RED's Projects API enables an attacker with the 'projects.read' permission to traverse arbitrary paths and access any file on the system. This can lead to unauthorized disclosure of sensitive information or even remote code execution if the attacker can access and execute malicious files. The vulnerability has been assigned the CVE identifier CVE-2021-21298 and has a severity rating of LOW. It has been fixed in Node-RED version 1.2.8.
How To Fix
Minimum fixed version
1.2.8
This is the first release that contains the fix.
npm install @node-red/runtime@1.2.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately update Node-RED, you can mitigate the vulnerability by not granting untrusted users read access to the Node-RED editor. This reduces the risk of exploitation as the vulnerability only affects the Projects feature, which is not enabled by default.
Conclusion
The vulnerability in Node-RED's Projects API allows for arbitrary path traversal, potentially leading to unauthorized access to sensitive files. It is important to update Node-RED to version 1.2.8 or later and disable the Projects feature if it is not needed. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for @node-red/runtime →
FAQ
Node-RED is an open-source flow-based programming tool used for creating applications by connecting hardware devices, APIs, and online services.
The Projects feature in Node-RED allows users to version control their flows and collaborate with others.
The vulnerability allows an attacker to traverse arbitrary paths and access any file on the system, potentially leading to unauthorized disclosure of sensitive information or remote code execution.
You can fix this vulnerability by updating Node-RED to version 1.2.8 or later. Make sure to disable the Projects feature if it is not required.
No, the Projects feature is not enabled by default in Node-RED.
References
Related vulnerabilities
Recent vulnerabilities recorded for @node-red/runtime.
