1 line
3.4 KiB
JSON
1 line
3.4 KiB
JSON
{"id": "GHSA-rg3m-cfq7-g6h6", "cve": "CVE-2026-43947", "repo": "frangoteam/FUXA", "cwes": ["CWE-863"], "vuln_files": ["server/api/command/index.js", "server/integrations/node-red/index.js"], "duration_sec": 102.9, "error": null, "strict": true, "lenient": true, "findings_scored": [{"fileMatch": true, "lineProx": true, "cweMatch": true, "hit": true, "title": "Node-RED admin auth bypass via unanchored URL substring match (\"/dashboard\") leading to RCE", "file": "server/integrations/node-red/index.js", "line": 160, "cwe": "CWE-287"}, {"fileMatch": true, "lineProx": false, "cweMatch": true, "hit": true, "title": "Node-RED SPA catch-all serves index from settings.httpStatic without sanitization (low)", "file": "server/integrations/node-red/index.js", "line": 280, "cwe": "CWE-285"}], "n_findings": 2, "findings": [{"title": "Node-RED admin auth bypass via unanchored URL substring match (\"/dashboard\") leading to RCE", "file": "server/integrations/node-red/index.js", "line": 160, "cwe": "CWE-287", "vuln_class": "auth-bypass", "severity": "critical", "description": "The allowDashboard middleware (mounted on app.use('/nodered', allowDashboard, RED.httpAdmin)) is the only authentication gate for the Node-RED admin/editor API; no adminAuth is configured in redSettings. At line 157 it builds url = req.originalUrl, which in Express includes the mount path AND the raw query string. Line 160 then grants public access with `if (url.includes('/dashboard') || url.includes('/socket.io')) return next();`. Because this is an unanchored substring test on the full URL+query, any request to a protected admin route that merely contains the substring '/dashboard' (or 'dashboard') anywhere\u2014including inside the query string\u2014short-circuits before the JWT / x-api-key validation, even when settings.secureEnabled is true. An unauthenticated attacker can therefore reach the full Node-RED admin REST API. Via POST /nodered/flows they can deploy a flow containing a Function node, which (with the broad functionGlobalContext exposing fs, fsSync, os, child_process when enabled, plus the FUXA runtime helpers like runScript/setTag) yields arbitrary file read/write and remote code execution on the FUXA host.", "poc": "1) Read flows unauthenticated: GET /nodered/flows?x=/dashboard HTTP/1.1 (url.includes('/dashboard') is true -> next() without token). 2) Deploy malicious flow unauthenticated: POST /nodered/flows?x=/dashboard with header 'Content-Type: application/json' and a flow array containing an inject node wired to a function node whose body uses the exposed global context, e.g. node 'func': {\"func\":\"const cp=global.get('child_process')||require('child_process'); cp.exec('id > /tmp/pwned'); return msg;\"} (or use fsSync to write a webshell). The deploy is accepted because authentication was bypassed, resulting in RCE.", "confidence": 0.9}, {"title": "Node-RED SPA catch-all serves index from settings.httpStatic without sanitization (low)", "file": "server/integrations/node-red/index.js", "line": 280, "cwe": "CWE-285", "vuln_class": "info-disclosure", "severity": "low", "description": "The same substring-based reasoning applies to the catch-all and exclusion logic using req.path.startsWith/includes; while less severe, the auth model around /nodered relies on fragile string matching. Secondary to the primary auth-bypass finding.", "poc": "GET /nodered/something?dashboard also bypasses the gate due to the same includes() check.", "confidence": 0.4}], "transcript": ""} |