CVE-2021-25864: Path Traversal in node-red-contrib-huemagic

Background

node-red-contrib-huemagic is an npm package that provides functionality for controlling Philips Hue lights in Node-RED. It allows users to integrate their Hue lights into their Node-RED flows and automate various lighting tasks. However, version 3.0.0 of this package is affected by a path traversal vulnerability. This vulnerability exists in the res.sendFile API used in the file hue-magic.js, which can be exploited to fetch arbitrary files by manipulating the 'hue/assets/..%2F' path.

Vulnerability Detail

The path traversal vulnerability in node-red-contrib-huemagic version 3.0.0 allows an attacker to access files outside of the intended directory. By manipulating the 'hue/assets/..%2F' path, an attacker can traverse the file system and retrieve sensitive files. This could lead to unauthorized access to sensitive information or the execution of malicious code. The vulnerability has a CVSS score of 7.5, indicating a high severity level.

Workaround

As a temporary workaround, you can manually modify the affected file, hue-magic.js, to implement proper input validation and sanitization. Here is an example of how to mitigate the vulnerability by adding input validation to the res.sendFile API:

// Add input validation to prevent path traversal
function sendFileWithValidation(res, filePath) {
  const safeFilePath = validateFilePath(filePath);
  res.sendFile(safeFilePath);
}

// Validate file path to prevent path traversal
function validateFilePath(filePath) {
  // Implement your validation logic here
  // Ensure the filePath is within the intended directory
  // Reject any filePath that contains '..' or '%2F'
  // Return the safe filePath
}

Conclusion

In conclusion, node-red-contrib-huemagic version 3.0.0 is affected by a path traversal vulnerability that can be exploited to access arbitrary files outside of the intended directory. It is recommended to upgrade to a non-vulnerable version of the package or apply the provided workaround. For further assistance with vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for node-red-contrib-huemagic →

FAQ