Prototype Pollution in Node-Red

Vulnerability

Overview

CVE-2021-21297 is a prototype pollution vulnerability in the Node-RED admin API affecting versions 1.2.7 and earlier. A specially crafted request can modify the prototype of the default JavaScript Object, potentially altering the default behavior of the Node-RED runtime [1][3].

Exploitation

The attack vector is the admin API, which requires network access to the editor URL. The vulnerability can be triggered by sending a badly formed request to the API. No authentication is mentioned as a prerequisite, but the workaround emphasizes restricting access to authorized users only [3].

Impact

Successful exploitation could lead to unintended changes in the runtime's default behavior, which may enable further attacks such as property injection or denial of service. The exact impact depends on how the runtime uses the polluted properties [1][3].

Mitigation

The vulnerability is patched in Node-RED version 1.2.8 [4]. As a workaround, administrators should ensure that only authorized users can access the editor URL [3].