NVD Vulnerability Detail

CVE-2021-21298

Summary	Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via the Projects API. The issue has been patched in Node-RED 1.2.8. The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED. The primary workaround is not give untrusted users read access to the Node-RED editor.
Publication Date	Feb. 27, 2021, 2:15 a.m.
Registration Date	Feb. 27, 2021, 10:02 a.m.
Last Update	Nov. 21, 2024, 2:47 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:nodered:node-red::::::node.js::*					1.2.8

Related information, measures and tools

No	URL	タグ
1	https://github.com/node-red/node-red/commit/74db3e17d075f23d9c95d7871586cf461524c456	Patch Third Party Advisory
2	https://github.com/node-red/node-red/commit/74db3e17d075f23d9c95d7871586cf461524c456	Patch Third Party Advisory
3	https://github.com/node-red/node-red/releases/tag/1.2.8	Release Notes Third Party Advisory
4	https://github.com/node-red/node-red/releases/tag/1.2.8	Release Notes Third Party Advisory
5	https://github.com/node-red/node-red/security/advisories/GHSA-m33v-338h-4v9f	Third Party Advisory
6	https://github.com/node-red/node-red/security/advisories/GHSA-m33v-338h-4v9f	Third Party Advisory
7	https://www.npmjs.com/package/%40node-red/runtime
8	https://www.npmjs.com/package/%40node-red/runtime

Common Vulnerabilities List

JVN Vulnerability Information

Node-Red におけるパストラバーサルの脆弱性

Title	Node-Red におけるパストラバーサルの脆弱性
Summary	Node-Red には、パストラバーサルの脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 2, 2021, midnight
Registration Date	Nov. 12, 2021, 10:19 a.m.
Last Update	Nov. 12, 2021, 10:19 a.m.

Affected System

Node-RED

Node-RED 1.2.7 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-21298	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21298
National Vulnerability Database (NVD)
2	CVE-2021-21298	https://nvd.nist.gov/vuln/detail/CVE-2021-21298

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-22	https://jvndb.jvn.jp/ja/cwe/CWE-22.html

ベンダー情報

No	Name	URL
GitHub
1	1.2.8: Maintenance Release	https://github.com/node-red/node-red/releases/tag/1.2.8
2	Path traversal via Projects API	https://github.com/node-red/node-red/security/advisories/GHSA-m33v-338h-4v9f
3	Restrict project file access to inside the project directory	https://github.com/node-red/node-red/commit/74db3e17d075f23d9c95d7871586cf461524c456
npm
4	@node-red/runtime	https://www.npmjs.com/package/@node-red/runtime

Change Log

No	Changed Details	Date of change
1	[2021年11月12日] 掲載	Nov. 12, 2021, 10:19 a.m.