Path traversal in Node-RED-Dashboard

Description

In Node-RED-Dashboard before 2.26.2 there is a path traversal vulnerability. It allows ui_base/js/..%2f directory traversal to read files.

Recommendation

Update the node-red-dashboard package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.26.2
• Patched version(s): 2.26.2

References

• GHSA-2hw7-mxvj-m455
• www.npmjs.com
• CVE-2021-3223
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• node-red-dashboard vulnerable to Cross-site Scripting - CVE-2022-3783
• Cross-site Scripting in node-red-dashboard - CVE-2019-10756
• Path traversal - CVE-2021-32662
• Path traversal in url-parse - CVE-2021-27515

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

node-red-dashboard