node-red-unauth: Node-RED - Unauthenticated Access

id: node-red-unauth

info:
  name: Node-RED - Unauthenticated Access
  author: 0xBassia
  severity: high
  description: |
    Node-RED flow editor is accessible without authentication. Node-RED is a flow-based programming tool that can execute arbitrary system commands, read/write files, and make network requests. Unauthenticated access leads to remote code execution.
  impact: |
    An attacker can create flows that execute system commands on the server, read sensitive files, establish reverse shells, or pivot to internal networks. Node-RED's exec node provides direct OS command execution.
  remediation: |
    Enable authentication in Node-RED settings.js by configuring adminAuth with username and bcrypt-hashed password. Restrict network access to trusted IPs only.
  reference:
    - https://nodered.org/docs/user-guide/runtime/securing-node-red
    - https://nodered.org/docs/user-guide/runtime/configuration
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"Node-RED"
  tags: misconfig,nodered,unauth,rce

http:
  - method: GET
    path:
      - '{{BaseURL}}/flows'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"id"'
          - '"type"'
          - '"wires"'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 4a0a0047304502203c769c4185abce44b5fa2af866770f434ee7c0df2275131756eed243f80a25e902210098d025a65bb18ca62e22c9f346f33078ff675057dc5b96730742c9c5e5a72df3:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.