CVE-2021-21297
📋 TL;DR
CVE-2021-21297 is a prototype pollution vulnerability in Node-RED's admin API that allows attackers to modify JavaScript object prototypes, potentially altering the runtime behavior of Node-RED applications. This affects all Node-RED instances running versions 1.2.7 or earlier. Attackers can exploit this vulnerability through specially crafted requests to the admin API.
💻 Affected Systems
- Node-RED
📦 What is this software?
Node Red by Nodered
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution, complete system compromise, or denial of service by polluting critical object prototypes and altering application behavior.
Likely Case
Application instability, denial of service, or privilege escalation through prototype manipulation affecting Node-RED functionality.
If Mitigated
Limited impact if proper authentication and authorization controls prevent unauthorized access to the admin API.
🎯 Exploit Status
Exploitation requires sending specially crafted requests to the admin API endpoints. Proof-of-concept code is available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.8 and later
Vendor Advisory: https://github.com/node-red/node-red/security/advisories/GHSA-xp9c-82x8-7f67
Restart Required: Yes
Instructions:
1. Update Node-RED using npm: 'npm install -g node-red@latest' 2. Restart the Node-RED service 3. Verify version is 1.2.8 or higher
🔧 Temporary Workarounds
Restrict Admin API Access
allEnsure only authorized users can access the Node-RED editor/admin interface by implementing proper authentication and network access controls.
Configure Node-RED settings.js to enable authentication
Use reverse proxy with authentication
Implement network firewall rules to restrict access
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Node-RED instances from untrusted networks
- Enable and enforce authentication for all admin API access with strong credentials
🔍 How to Verify
Check if Vulnerable:
Check Node-RED version: 'node-red --version' or examine package.json. If version is 1.2.7 or earlier, the system is vulnerable.Check Version:
node-red --versionVerify Fix Applied:
After patching, verify version is 1.2.8 or higher: 'node-red --version' should show 1.2.8+📡 Detection & Monitoring
Log Indicators:
- Unusual POST/PUT requests to /admin/* endpoints
- Requests with malformed JSON payloads to admin API
- Error logs mentioning prototype pollution or object manipulation
Network Indicators:
- HTTP requests to Node-RED admin endpoints from unexpected sources
- Unusual traffic patterns to /admin/* paths
SIEM Query:
source="node-red" AND (uri_path="/admin/*" AND (http_method="POST" OR http_method="PUT") AND status_code=200)🔗 References
- https://github.com/node-red/node-red/releases/tag/1.2.8
- https://github.com/node-red/node-red/security/advisories/GHSA-xp9c-82x8-7f67
- https://www.npmjs.com/package/%40node-red/editor-api
- https://www.npmjs.com/package/%40node-red/runtime
- https://github.com/node-red/node-red/releases/tag/1.2.8
- https://github.com/node-red/node-red/security/advisories/GHSA-xp9c-82x8-7f67
- https://www.npmjs.com/package/%40node-red/editor-api
- https://www.npmjs.com/package/%40node-red/runtime
