mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
TigahandGitHub
64e3f540a9
add a recon module for an exposed node-red admin api; with adminAuth unset the /flows endpoint returns the flow configuration without a token and the open admin api allows flow deployment that runs arbitrary code through function and exec nodes, while a secured instance returns 401.
40 lines
801 B
YAML
40 lines
801 B
YAML
# Node-RED Flow API Exposure Detection Module
|
|
|
|
id: nodered-flow-exposure
|
|
info:
|
|
name: Node-RED Flow API Exposure
|
|
author: sif
|
|
severity: high
|
|
description: Detects a Node-RED instance with adminAuth unset whose flows api leaks the full flow config and accepts code-executing deploys
|
|
tags: [node-red, nodered, low-code, automation, iot, flow, rce, exposure, unauth, recon]
|
|
|
|
type: http
|
|
|
|
http:
|
|
method: GET
|
|
paths:
|
|
- "{{BaseURL}}/flows"
|
|
|
|
matchers:
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- '"type"\s*:\s*"tab"'
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "\"wires\""
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: nodered_flow_label
|
|
part: body
|
|
regex:
|
|
- '"label"\s*:\s*"([^"]*)"'
|
|
group: 1
|